It is well known that text book ElGamal is not IND-CCA secure, because an attacker can just have $$(Y,W)\leftarrow E_{x}(LR(M1,M2,b))$$ where M1, and M2 can be any message in the group, and than just query the decryption oracle something like $$M\leftarrow D_{x}(Y,W\cdot g)$$ and test if M = M1 . g, return 0, otherwise 1.

But what happen if we added a sort of "mac and hash" to the textbook ElGamal ? like if you want to encrypt message M, it actrually running $$E_{x}(M) \Rightarrow E_{x}(M||H(M))$$, and the decryption oracle check $$M* \leftarrow WK^{-1}$$, and break M* back to M || N and only return if N = H(M). Is this fix the the ElGamal security issue and make it IND-CCA?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.