# Retrieving correct ciphertext from additive ElGamal

I have been studying additive ElGamal and I think I have the hang of it except the part where the message $$M$$ must be retrieved by computing the discrete log of $$g^M$$.

From what I've read, the result of such computations is a function of $$k$$ e.g. for $$g=3, M=4, \pmod{17}$$ we have $$3^4=13 \pmod{17}$$ but computing the discrete log however gives $$M=4 + 16k$$. How do I know that $$M=4$$ and not $$M=20$$?

Note that for $$g=3,M=20 \pmod{17}$$ we also get $$M=4+16k$$.

To solve this issue you have to limit your message space into $$\pmod{17}$$ and divide your longer message block in an appropriate way. Now, you know, you have to take the smallest positive value where $$k=0$$.