assume Bob and Alice use Elgamal encryption scheme. Alice wants to send Bob a message, but does not know Bobs public key. Is there a way for Alice to find out Bobs public key by receiving multiple message pairs C1 (ephemeral key) and C2 (message) from Bob? Alice can easily decrypt Bobs messages, as from Bob to Alice the shared K is known by Alice. But Alices messages to Bob cannot be correctly decrypted by Bob, as the messages were not created by using Bobs public key but a random number.
Thanks for any help.