# Undefined $E_y(1,r_{i,j,1})$ notation in cryptography paper, suspect ElGamal-like

I'm trying to understand a paper that uses the notation $E_y(1,r_{i,j,1})$ (full text available in link, used just once on Page #35, 6th page of pdf, Section 3.3, Step 1c) in the context of an encryption similar to ElGamal. I don't understand why/how $E_y()$ takes two inputs.

The $r_{i,j,n}$ part is well defined (series of random numbers). I've figured out $E_y(x)$, which isn't defined in the paper, but used as an ElGamal-like encryption with previously defined public key $y$ (not to be confused with the $E_{k,i}$ or $E_k$ terms which aren't functions and are just lists of cards for the $k$th deck of cards), though I had originally thought $E_y(x)=xy^r$, based off the proof of theorem 2 on the very last page I think it is the ordered tuple $E_y(x)=(g^r,xy^r)$.

What could two arguments represent? I'm guessing one is the message to be encrypted, and the other is specifying the $g$ or $r$ term.

## 1 Answer

An ElGamal ciphertext encrypting a message $m$ (as you say) is a tuple $(g^k,m\cdot y^k)$ when working in a group $G$ generated by $g$ with public key $y$.

Some people make the "randomizer" $k$ explicit by writing $E_y(m,k)=(g^k,my^k)$ to denote that they can control and know this input and that this input is not freely chosen by the encryption algorithm (typically if one uses ElGamal encryption as a commitment and requires proofs of knowledge about the plaintext - I guess this is what the guys do). So, people often write $E_y(m)$ if they do not care what the value of $k$ is and write $E_y(m,k)$ if they want to know what the value of $k$ is. Then, $E_y(1,k)$ is just an encryption of the identity in $G$ giving ciphertext $(g^k,y^k)$.