# Is ElGamal IND-CCA1?

We all know that textbook ElGamal falls due to chosen ciphertext attacks, because of its multiplicative homomorphic property ($E(A)*E(B)=E(AB)$).

However these attacks require the ciphertext ($E(A)$ or $E(B)$) to be given, meaning as per this answer this would mean ElGamal isn't IND-CCA2, but IND-CCA1 as the access to a decryption oracle before the ciphertext is known doesn't help anything.

Hence my question:
Is the ElGamal encryption scheme IND-CCA1 or "only" IND-CPA?

"Bonus" question:
If the ElGamal encryption scheme isn't IND-CCA1 how would the CCA1 attack look like?

• In the paper link.springer.com/chapter/10.1007%2F3-540-46766-1_36. It says $E(m) = (g^{r}, y^{r} \oplus m)$. But I remember that the encryption algorithm is that $E(m) = (g^{r}, y^{r} \cdot m)$? Which one is correct? Jan 22, 2019 at 13:31