5
$\begingroup$

I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and encryption.

Can each party use the same key-pair for both schemes?

I know that encryption/signature key lifetimes and security key-lengths may be different, but this would not pose any serious risk to our system.

So the question can be restated as: Are there passive or active attacks (e.g. algebraic, chosen-plaintext/ciphertext) that are specifically targeted at users sharing ElGamal Encryption/Signature key-pairs?

Improve this question
$\endgroup$
5
  • $\begingroup$ I can't find anything about joint security of elgamal. Some related but not entirely fitting papers: google.com/?q=%22joint+security%22+signature $\endgroup$
    – CodesInChaos
    Oct 29, 2012 at 19:41
  • 1
    $\begingroup$ Can you store a single seed in the device from which you derive the two actual private keys with a KDF? That way you get a single small private key. But obviously it doubles the size of the public key. $\endgroup$
    – CodesInChaos
    Oct 29, 2012 at 20:00
  • $\begingroup$ Unluckily not. Every user must have a single key pair. $\endgroup$
    – SDL
    Oct 30, 2012 at 14:10
  • $\begingroup$ Maybe the paper Digital Signcryption or How to Achieve Cost(Signature & Encryption) << Cost(Signature) + Cost(Encryption) from Y. Zheng can be interesting for you. He introduced an ElGamal signcryption sheme with only a single key-pair. $\endgroup$
    – Ekris
    Oct 30, 2012 at 21:17
  • $\begingroup$ A Robust and Plaintext-Aware Variant of Signed ElGamal Encryption might be interesting, combining ElGamal encryption with Schnorr signatures. $\endgroup$
    – CodesInChaos
    Nov 21, 2012 at 21:36

1 Answer 1

Reset to default
2
$\begingroup$

It depends.

It depends on a lot of things. For example a generator of 2 is great for encryption, but makes for awful signatures. If you use a generator of 2, then no. Your signatures will get broken. Then the encryption will.

Elgamal signatures are pretty controversial. They're tetchy to get right (see above) and there are many things you can get wrong. Also, they're large, when compared to DSA. DSA is a modification of Elgamal signatures and designed so that the size of the signature is proportional to the size of the hash, not the size of the key. They're thus smaller.

They were added into OpenPGP for RFC 2440, and implemented in GnuPG but not in PGP, because of security/implementation concerns that PGP developers had. A serious bug was found in the GnuPG implementation and then were removed from GnuPG, and then from RFC 4880 as no one was implementing them.

Ask yourself why you're doing them rather than DSA, research the problems people had in the past, and make sure you've done it right.

Jon

Improve this answer
$\endgroup$
3
  • $\begingroup$ Could you point out links or papers where the ElGamal signature scheme implementation flaws are discussed? Thanks. $\endgroup$
    – SDL
    Oct 30, 2012 at 18:27
  • $\begingroup$ Nevertheless the same question applies to ElGamal encryption sharing key-pairs with DSA. Can one interfere with the other? $\endgroup$
    – SDL
    Oct 30, 2012 at 18:28
  • 1
    $\begingroup$ DSA is not more "secure" than ElGamal signatures, because they are essentially the same computations with different names. The only difference is that DSA operates on a subgroup of cardinality q, while ElGamal operates on all p-1 with the annotation "p-1 needs at least one large prime factor". Otherwise they are the same. This is also the reason for smaller signatures, so that q matches the number of possible hash-outputs. If you rather follow the ElGamal algorithm and replace every "p-1" with "q" and choose the generator appropriately (cardinality q), they are the same. $\endgroup$
    – tylo
    Jun 13, 2013 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.