8 reputation
3
bio website
location
age
visits member for 1 year, 11 months
seen Nov 19 at 2:38

May
26
comment weaknesses in ElGamal with public key of small order
I hadn't thought about using quadratic residues this way ("if the first element of the ciphertext $c_1$ is a quadratic residue you can derive that $k$ has to be even").
May
26
comment weaknesses in ElGamal with public key of small order
Note that I wrote $k_E$, not $k_M$, wich $k_E=\alpha^i$, $i$ being chosen by Alice. So yes, that was just a misunderstanding. Thank you for your answer!
May
25
comment weaknesses in ElGamal with public key of small order
sadly in this case most of the time when $c$ is a quadratic non-residue, so are both of the possible $m$. So it only helps deciding between the two at a few instances. Also quadratic residues have not been mentioned before, so I believe the answer must be something else. Probably something simple I have overlooked.
May
24
comment weaknesses in ElGamal with public key of small order
@DrLecter "your public key to the power of the masking key"? To my understanding, the masking key $k_M$ is computed as $\beta ^i$ where $i\in \{2,...,27\}$ is chosen randomly by Alice, and is then used to encrypt ("mask") the plaintext $c=m*k_M$. That means that the masking key $k_M$ as a power of Bob's public key $\beta$ can only be $1$ or $28$. That is in line with what the exercise itself hints at: "use the fact that there are only very few masking keys". I'll look at the quadratic residue.
May
23
comment weaknesses in ElGamal with public key of small order
Thank you. I updated the question with the complete exercise quote.
May
23
comment weaknesses in ElGamal with public key of small order
I hope you understand what I mean. It's related to an exercise, and I believe I missed something.
May
23
comment weaknesses in ElGamal with public key of small order
thanks for your answer. 28 (-1) is the given public key. Given that calculated the private key to be 14. But I know that it's specifically weak because of 28's order. What I was asking about, though, is what I did not get about the mentioned "task" to decrypt the given ciphertext without computing Bob's private key, by "using the fact that there are only very few masking keys" (2 in fact) "and a bit of guesswork". I do not know what is meant with the guesswork. Since the result I calculated with the private key (not allowed) seems random, I don't how I should otherwise know the correct result.