In normal ElGamal encryption, the encrypted message is a pair
(gb, gabM)- that is, the actual "encryption" is simply multiplication by the shared secretgab.A common pattern with public-key encryption is to encrypt a symmetric key using PK, and then encode the actual message with the symmetric key.
It seems to me that you could simply use the shared secret gab as your symmetric key instead - so your pair would be (gb, AES(M, gab)). (This looks extremely similar to agreeing on an AES key via Diffie-Hellman.) This would take up less space, putting it on even footing with RSA + AES for a given key-/group-size.
So: has anybody heard of a scheme like this? If so, does it have a name, and is it actually used? As for why I'm interested:
Possible advantage: semantic security without DDH?
In normal ElGamal, we lose semantic security if we don't have DDH (given ga, gb and c, we can test whether c = gab). AFAIU, this is because the message is encoded as E = gabM mod p, so you can divide by your suspected message (c = gabM/Mguess), and test whether it matches gab.
It seems to me that if we use gab to provide an AES key instead, then recovering a candidate c is equivalent to recovering an AES key from a plaintext/ciphertext pair. I understand that AES is not susceptible to known-plaintext attacks, so does this mean we have semantic security even without DDH?
Possible advantage: easier generation of private keys?
With RSA, it takes a reasonable chunk of computational effort to generate a new public/private key pair (because you have to find a probably prime). With ElGamal, it seems much easier, which means you could rotate your short-term keys much more often, without draining a low-power device.
The more often you rotate your short-term keys, the "better" your forward secrecy is. (After all, if you rotated your keys so often that each one was only ever used once, then you're basically doing Diffie-Hellman, just re-ordered a bit.)
