1
$\begingroup$

I was reading the Coercion-Resistant Electronic Election paper and don't understand why the authors chose a modified version of ElGamal.

enter image description here

I guess that it was for security reasons. If so, what are the security issues of using a basic ElGamal scheme?

$\endgroup$
1
  • 1
    $\begingroup$ Thanks for directly linking to the article. For future readers, they mention here that the decision will become apparent "later". Funny enough, if you keep on reading then in the appendices they will indicate that "As mentioned before our modified version of the El Gamal cryptosystem can be seen as a simplified version of the Cramer-Shoup [17], method." I haven't been able to find anything in the text that clearly does provide this explanation. This is what you get if you don't include any well defined internal references in a paper. I hope somebody can answer based on knowledge instead. $\endgroup$
    – Maarten Bodewes
    Commented Aug 6, 2023 at 12:50

1 Answer 1

1
$\begingroup$

It looks like your version is not their final version of the paper, which threw me off too, and probably the reviewers considering how much text they added. M-El Gamal is significantly different and is given a bit more explanation in this version: https://dl.acm.org/doi/pdf/10.1145/1102199.1102213. They say they can't make their simulator decrypt normal El Gamal, but they apparently can with this modified version. In case you don't have access to the full PDF, I am taking a screenshot of their description and putting it below. I will note that they have a broken section reference, which is very annoying, as El Gamal is only mentioned in one other area in the paper and it is not related to this. The gist that I am getting is that it is for their security proofs.

I personally don't see any real security benefits. The only interesting thing I see is that you can't determine $x_1$ and $x_2$ from $y$, as $y$ is effectively a Pedersen Commitment and is perfectly hiding. However, that doesn't seem to do anything. As far as I can tell, if $g_2 = g_1 ^ a$, then $(g_1^r, g_2^r, y^rm)$ with $y=g_1^{x_1} \cdot g_2 ^{x_2}$ is the same as $(g_1^r, y^rm)$ where $y = g_1^{x_1+ax_2}$, and I don't see how that helps anything, so I'm not sure where the benefit comes from in their simulations. I guess it takes two discrete logs to break instead of one, but I don't see why that would be relevant.

enter image description here

I'm not sure this is a good answer, but I can't post a screen shot in a comment, so I am posting it as an answer. This does provide some explanation the OP is asking for though, but I personally still find it unsatisfactory.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.