From Christof Paar's book

The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes his private key $d$ and public key $β$. This key pair does not change, i.e., it can be used for encrypting many messages. Alice, however, has to generate a new public–private key pair for the encryption of every message. Her private key is denoted by $i$ and her public key by $k\,E$. The latter is an ephemeral (existing only temporarily) key, hence the index $E$. The joint key is denoted by $k,M$ because it is used for masking the plaintext.

So why does Bob get to use the same keypair while Alice has to generate a new keypair every time?

Also, in case of TLS/HTTP, between a Browser & a Website - which one is Alice & which one is Bob?

  • 1
    $\begingroup$ Is the question about ElGamal or Diffie-Hellman? The answer differs between the two (and TLS uses DH) $\endgroup$
    – poncho
    Oct 27, 2020 at 13:01
  • $\begingroup$ @poncho - It's about Elgamal - the author talks about DHKE only to say that Elgamal does the same the beginning steps of DHKE $\endgroup$
    – user93353
    Oct 27, 2020 at 14:32

1 Answer 1


So why does Bob get to use the same keypair while Alice has to generate a new keypair every time?

Because ElGamal is insecure if Alice picks the same keypair repeatedly.

ElGamal is a public key encryption system; Bob has a long term public key, which he generates once, and hence Bob has to select once private key $b$ and a long term public key $B = G^b$ (note: I don't have the Paar book, hence I don't know what notation he uses).

In contrast, Alice encrypts a message $M$ using Bob's public key $B$; what she does is select a random value $r$ and produce the pair $G^r$ and $M \cdot B^r$.

This is fine; however suppose Alice encrypts a second message $M'$ also to Bob and uses the same random value $r$; this second ciphertext would be $G^r$ and $M' \cdot B^r$.

Why is this bad? Well, someone seeing both ciphertexts can reconstruct $(M \cdot B^r) (M' \cdot B^r)^{-1} = M \cdot M'^{-1}$. This is more information than we want someone listening in to obtain; in particular, if they happen to know one of the messages (say, $M'$), they can recover the other ($M$).

If Alice selects a fresh random value each time, this does not happen.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.