foaly
Reputation
Top tag
Next privilege 10 Rep.
 May26 comment weaknesses in ElGamal with public key of small order I hadn't thought about using quadratic residues this way ("if the first element of the ciphertext $c_1$ is a quadratic residue you can derive that $k$ has to be even"). May26 awarded Scholar May26 accepted weaknesses in ElGamal with public key of small order May26 comment weaknesses in ElGamal with public key of small order Note that I wrote $k_E$, not $k_M$, wich $k_E=\alpha^i$, $i$ being chosen by Alice. So yes, that was just a misunderstanding. Thank you for your answer! May25 comment weaknesses in ElGamal with public key of small order sadly in this case most of the time when $c$ is a quadratic non-residue, so are both of the possible $m$. So it only helps deciding between the two at a few instances. Also quadratic residues have not been mentioned before, so I believe the answer must be something else. Probably something simple I have overlooked. May24 awarded Student May24 comment weaknesses in ElGamal with public key of small order @DrLecter "your public key to the power of the masking key"? To my understanding, the masking key $k_M$ is computed as $\beta ^i$ where $i\in \{2,...,27\}$ is chosen randomly by Alice, and is then used to encrypt ("mask") the plaintext $c=m*k_M$. That means that the masking key $k_M$ as a power of Bob's public key $\beta$ can only be $1$ or $28$. That is in line with what the exercise itself hints at: "use the fact that there are only very few masking keys". I'll look at the quadratic residue. May23 comment weaknesses in ElGamal with public key of small order Thank you. I updated the question with the complete exercise quote. May23 revised weaknesses in ElGamal with public key of small order added 861 characters in body May23 awarded Editor May23 revised weaknesses in ElGamal with public key of small order added 415 characters in body May23 comment weaknesses in ElGamal with public key of small order I hope you understand what I mean. It's related to an exercise, and I believe I missed something. May23 comment weaknesses in ElGamal with public key of small order thanks for your answer. 28 (-1) is the given public key. Given that calculated the private key to be 14. But I know that it's specifically weak because of 28's order. What I was asking about, though, is what I did not get about the mentioned "task" to decrypt the given ciphertext without computing Bob's private key, by "using the fact that there are only very few masking keys" (2 in fact) "and a bit of guesswork". I do not know what is meant with the guesswork. Since the result I calculated with the private key (not allowed) seems random, I don't how I should otherwise know the correct result. May23 asked weaknesses in ElGamal with public key of small order