# Elgamal Encryption: Why does Bob get to reuse his keypair while Alice has to generate a new one for every message?

From Christof Paar's book

The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes his private key $$d$$ and public key $$β$$. This key pair does not change, i.e., it can be used for encrypting many messages. Alice, however, has to generate a new public–private key pair for the encryption of every message. Her private key is denoted by $$i$$ and her public key by $$k\,E$$. The latter is an ephemeral (existing only temporarily) key, hence the index $$E$$. The joint key is denoted by $$k,M$$ because it is used for masking the plaintext.

So why does Bob get to use the same keypair while Alice has to generate a new keypair every time?

Also, in case of TLS/HTTP, between a Browser & a Website - which one is Alice & which one is Bob?

• Is the question about ElGamal or Diffie-Hellman? The answer differs between the two (and TLS uses DH) Oct 27 '20 at 13:01
• @poncho - It's about Elgamal - the author talks about DHKE only to say that Elgamal does the same the beginning steps of DHKE Oct 27 '20 at 14:32

So why does Bob get to use the same keypair while Alice has to generate a new keypair every time?

Because ElGamal is insecure if Alice picks the same keypair repeatedly.

ElGamal is a public key encryption system; Bob has a long term public key, which he generates once, and hence Bob has to select once private key $$b$$ and a long term public key $$B = G^b$$ (note: I don't have the Paar book, hence I don't know what notation he uses).

In contrast, Alice encrypts a message $$M$$ using Bob's public key $$B$$; what she does is select a random value $$r$$ and produce the pair $$G^r$$ and $$M \cdot B^r$$.

This is fine; however suppose Alice encrypts a second message $$M'$$ also to Bob and uses the same random value $$r$$; this second ciphertext would be $$G^r$$ and $$M' \cdot B^r$$.

Why is this bad? Well, someone seeing both ciphertexts can reconstruct $$(M \cdot B^r) (M' \cdot B^r)^{-1} = M \cdot M'^{-1}$$. This is more information than we want someone listening in to obtain; in particular, if they happen to know one of the messages (say, $$M'$$), they can recover the other ($$M$$).

If Alice selects a fresh random value each time, this does not happen.