Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and encryption.

Can each party use the same key-pair for both schemes?

I know that encryption/signature key lifetimes and security key-lengths may be different, but this would not pose any serious risk to our system.

So the question can be restated as: Are there passive or active attacks (e.g. algebraic, chosen-plaintext/ciphertext) that are specifically targeted at users sharing ElGamal Encryption/Signature key-pairs?

share|improve this question
    
I can't find anything about joint security of elgamal. Some related but not entirely fitting papers: google.com/?q=%22joint+security%22+signature –  CodesInChaos Oct 29 '12 at 19:41
1  
Can you store a single seed in the device from which you derive the two actual private keys with a KDF? That way you get a single small private key. But obviously it doubles the size of the public key. –  CodesInChaos Oct 29 '12 at 20:00
    
Unluckily not. Every user must have a single key pair. –  SDL Oct 30 '12 at 14:10
    
Maybe the paper Digital Signcryption or How to Achieve Cost(Signature & Encryption) << Cost(Signature) + Cost(Encryption) from Y. Zheng can be interesting for you. He introduced an ElGamal signcryption sheme with only a single key-pair. –  Ekris Oct 30 '12 at 21:17
    
A Robust and Plaintext-Aware Variant of Signed ElGamal Encryption might be interesting, combining ElGamal encryption with Schnorr signatures. –  CodesInChaos Nov 21 '12 at 21:36
add comment

1 Answer 1

It depends.

It depends on a lot of things. For example a generator of 2 is great for encryption, but makes for awful signatures. If you use a generator of 2, then no. Your signatures will get broken. Then the encryption will.

Elgamal signatures are pretty controversial. They're tetchy to get right (see above) and there are many things you can get wrong. Also, they're large, when compared to DSA. DSA is a modification of Elgamal signatures and designed so that the size of the signature is proportional to the size of the hash, not the size of the key. They're thus smaller.

They were added into OpenPGP for RFC 2440, and implemented in GnuPG but not in PGP, because of security/implementation concerns that PGP developers had. A serious bug was found in the GnuPG implementation and then were removed from GnuPG, and then from RFC 4880 as no one was implementing them.

Ask yourself why you're doing them rather than DSA, research the problems people had in the past, and make sure you've done it right.

Jon

share|improve this answer
    
Could you point out links or papers where the ElGamal signature scheme implementation flaws are discussed? Thanks. –  SDL Oct 30 '12 at 18:27
    
Nevertheless the same question applies to ElGamal encryption sharing key-pairs with DSA. Can one interfere with the other? –  SDL Oct 30 '12 at 18:28
1  
DSA is not more "secure" than ElGamal signatures, because they are essentially the same computations with different names. The only difference is that DSA operates on a subgroup of cardinality q, while ElGamal operates on all p-1 with the annotation "p-1 needs at least one large prime factor". Otherwise they are the same. This is also the reason for smaller signatures, so that q matches the number of possible hash-outputs. If you rather follow the ElGamal algorithm and replace every "p-1" with "q" and choose the generator appropriately (cardinality q), they are the same. –  tylo Jun 13 '13 at 16:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.