Elgamal Encryption: Why does Bob get to reuse his keypair while Alice has to generate a new one for every message?

Question

From Christof Paar's book

The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes his private key $d$ and public key $β$. This key pair does not change, i.e., it can be used for encrypting many messages. Alice, however, has to generate a new public–private key pair for the encryption of every message. Her private key is denoted by $i$ and her public key by $k\,E$. The latter is an ephemeral (existing only temporarily) key, hence the index $E$. The joint key is denoted by $k,M$ because it is used for masking the plaintext.

So why does Bob get to use the same keypair while Alice has to generate a new keypair every time?

Also, in case of TLS/HTTP, between a Browser & a Website - which one is Alice & which one is Bob?

Answer 1

So why does Bob get to use the same keypair while Alice has to generate a new keypair every time?

Because ElGamal is insecure if Alice picks the same keypair repeatedly.

ElGamal is a public key encryption system; Bob has a long term public key, which he generates once, and hence Bob has to select once private key $b$ and a long term public key $B = G^b$ (note: I don't have the Paar book, hence I don't know what notation he uses).

In contrast, Alice encrypts a message $M$ using Bob's public key $B$; what she does is select a random value $r$ and produce the pair $G^r$ and $M \cdot B^r$.

This is fine; however suppose Alice encrypts a second message $M'$ also to Bob and uses the same random value $r$; this second ciphertext would be $G^r$ and $M' \cdot B^r$.

Why is this bad? Well, someone seeing both ciphertexts can reconstruct $(M \cdot B^r) (M' \cdot B^r)^{-1} = M \cdot M'^{-1}$. This is more information than we want someone listening in to obtain; in particular, if they happen to know one of the messages (say, $M'$), they can recover the other ($M$).

If Alice selects a fresh random value each time, this does not happen.