I need securely asymmetrically encrypt the up to 16 bytes plaintext and receive up to 32 bytes ciphertext. I found that ElGamal produces ciphertext that is 2 times keysize. So I would need to use 128bits keysize, which are not secure enough. I can use any keysize, but the ciphertext must not exceed 32bytes. Is it possible with other schemes?