I'm trying to understand a paper that uses the notation $E_y(1,r_{i,j,1})$ (full text available in link, used just once on Page #35, 6th page of pdf, Section 3.3, Step 1c) in the context of an encryption similar to ElGamal. I don't understand why/how $E_y()$ takes two inputs.

The $r_{i,j,n}$ part is well defined (series of random numbers). I've figured out $E_y(x)$, which isn't defined in the paper, but used as an ElGamal-like encryption with previously defined public key $y$ (not to be confused with the $E_{k,i}$ or $E_k$ terms which aren't functions and are just lists of cards for the $k$th deck of cards), though I had originally thought $E_y(x)=xy^r$, based off the proof of theorem 2 on the very last page I think it is the ordered tuple $E_y(x)=(g^r,xy^r)$.

What could two arguments represent? I'm guessing one is the message to be encrypted, and the other is specifying the $g$ or $r$ term.


1 Answer 1


An ElGamal ciphertext encrypting a message $m$ (as you say) is a tuple $(g^k,m\cdot y^k)$ when working in a group $G$ generated by $g$ with public key $y$.

Some people make the "randomizer" $k$ explicit by writing $E_y(m,k)=(g^k,my^k)$ to denote that they can control and know this input and that this input is not freely chosen by the encryption algorithm (typically if one uses ElGamal encryption as a commitment and requires proofs of knowledge about the plaintext - I guess this is what the guys do). So, people often write $E_y(m)$ if they do not care what the value of $k$ is and write $E_y(m,k)$ if they want to know what the value of $k$ is. Then, $E_y(1,k)$ is just an encryption of the identity in $G$ giving ciphertext $(g^k,y^k)$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.