# Can elliptic curve groups be used for commutative encryption?

In trying to implement mental poker, can all players agree on a standard set of 52 points on the curve corresponding to each card, and then to "encrypt" a card you just multiply it by a scalar which is your encryption key? (and to decrypt, multiply by the scalar's inverse modulo the group size)

• Can you clarify what you mean by commutative in this context? Commented Dec 4, 2022 at 12:27
• Ek(Ej(X)) = Ej(Ek(X)) where Ek(X) is encryted versions of X under key K. It's from the mental poker paper Shamir Rivest and Adleman. They call this property "commutativity of encryption". Commented Nov 4, 2023 at 19:01

E.g. if $$5♠$$ is point $$P$$, and $$6♦$$ is point $$Q$$, and your encryption scalar is $$x$$, then you could encrypt $$5♠$$ using $$P' = xP$$. Now, if you know $$y=P/Q$$, then you could pretend you had encrypted $$6♦$$ instead of $$5♠$$ by declaring your encryption key as $$z=xy$$, because $$z^{-1}P'=(xy)^{-1}P'=(xP/Q)^{-1}P'=(xP/Q)^{-1}xP=(Q/xP)xP=Q$$
I'd recommend you use a hash-to-curve method to produce the point $$P$$ by hashing the string $$5♠$$. The discrete logs of hash-to-curve points with respect to other curve points are unknowable.
In contrast, it would be catastrophic if you'd chosen points such that each point was a base point $$G$$ added to itself between 1 and 52 times, depending on the card.