# Reusing the random exponent for ElGamal encryption with different plaintexts

In the basic ElGamal encryption scheme, we encrypt a message $m$ as $(g^r, h^r m)$, where $g$ is the group generator and $h$ is the public key of the recipient.

If the sender has another message $m'$ to send to the recipient, can they use the same random $r$ in the construction without decreasing the security of the scheme? More generally, with $n$ different messages $(m_1, m_2, \dotsc, m_n)$, is it safe to encrypt them as $(g^r, h^r m_1, h^r m_2, \dotsc, h^r m_n)$?

No, you can't. In this case, an attacker can compute $m_1/m_2$ by multiplying the first ciphertext for the inverse of the second and, for instance, determine if $m_1=m_2$ or not. This should not be possible in a secure scheme.
• Yes, either that or having 2 secret keys and 2 corresponding public keys $h_1,h_2$ – Florian Bourse Mar 10 '15 at 12:50
• secret keys are $s_1,s_2$, public keys are $h_i=g^{s_i}$ and ciphertext is $g^r,h_1^rm_1,h_2^rm_2$. – Florian Bourse Mar 10 '15 at 17:08