Is there a way to prove/verify that an exponential ElGamal ciphertext of a message representative $\widetilde{m}=mG$ is well-formed, meaning that $r_1 = r_2$ in:

$$C = (R, S) = (r_1G, \widetilde m + r_2Y)$$

with $Y = xG$.

  • $\begingroup$ What is the worry of this question? Because of the encryptor chooses $r_1\neq r_2$ they're just hurting themselves because they're actually encrypting a different unintended message. So is message modification on an existing ciphertext? $\endgroup$
    – SEJPM
    Jan 15, 2020 at 11:24
  • $\begingroup$ Basically I need to sum a bunch of ElGamal ciphertexts and decrypt the total. If one part is malicious he can bad form his ciphertext and invalidate the decryption. $\endgroup$
    – Fiono
    Jan 15, 2020 at 11:32
  • $\begingroup$ In that case he can also just create a sum using the wrong number. I think you need an entire structure for message integrity / authentication rather than a way to simply validate ciphertext. This leans more towards signatures and (Dare I say it? Bugger it, I'll say it!) blockchain technologies, if you ask me. $\endgroup$
    – Maarten Bodewes
    Jan 17, 2020 at 16:00
  • $\begingroup$ That is not exponential ElGamal. It is the normal ElGamal with additive notation. Which fairly misleading, since that is it actually what people think of as "addition (of integers or similar)". $\endgroup$
    – tylo
    Jan 17, 2020 at 16:11
  • 1
    $\begingroup$ @tylo: my reading of both the original and current question is that it is expoential ElGamal, only in a group noted additively rather than multiplicatively as there. $\endgroup$
    – fgrieu
    Jan 17, 2020 at 16:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.