5
$\begingroup$

As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption.

So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it means that the users have their shared key. So why can't AES keys be generated from shared keys, and why not use only AES for message encryption after this point?

Actually I am confused about this: if there is a shared key from a DH key exchange, why are we still talking about ElGamal asymmetric message encryption, isn't it confusing for a learner like me, to study that , firstly a secret key is sufficient to do encryption using faster symmetric encryptions and also talking about an asymmetric encryption that is based on shared secret key. Isn't learning Elgamal unnecessary and confusing? If not, is there any particular application that uses elgamal, because I do not find any solid application.

|improve this question
$\endgroup$
  • $\begingroup$ I agree with you. ElGamal is only useful in niche applications. For normal usage DH is preferable. $\endgroup$ – CodesInChaos Jul 31 '13 at 12:17
  • $\begingroup$ @CodesinChaos: Happy to know I am somewhat wright at the point as you have agreed with me. But I would like to hear more on reasons for its existence and where it is applied. I want to be sure that I am not opposing anyone but just want to know the reasons because I am really confused and thinking about it. $\endgroup$ – smslce Jul 31 '13 at 12:27
  • $\begingroup$ cleaned up some comments from prior version $\endgroup$ – mikeazo Jul 31 '13 at 13:44
  • 1
    $\begingroup$ Many algorithms are not commonly used in practice, yet they are interesting to learn about. $\endgroup$ – Aleph Jun 24 '15 at 15:52
6
$\begingroup$

So why can't AES keys be generated from shared keys, and why not use only AES for message encryption after this point?

That is exactly what is done.

if there is a shared key from a DH key exchange, why are we still talking about ElGamal asymmetric message encryption

Remember, DH is just one way to exchange a key. DH has its problems (no authentication). Using ElGamal is another way someone could exchange a key. It would typically be used as follows: Use AES to encrypt a large message with a random key for Bob. Encrypt that random key using Bob's ElGamal (or RSA if you prefer) public key. Send both to Bob. Bob decrypts the random key using his private key, then uses AES to decrypt the message. You are correct in that ElGamal (or any public-key cipher for that matter) is rarely used to send encrypted messages.

Isn't learning Elgamal unnecessary and confusing?

If you are only learning DH and nothing else, then definitely not. DH does not provide digital signatures, does not provide authentication, does not provide encryption. It only exchanges a key (and is succeptible to a man-in-the-middle attack). Learning about ElGamal can provide the opportunity to discuss all these other things that you do not get with DH alone. That said, when I took a network security class we didn't discuss ElGamal at all. We instead learned about RSA as a way of doing digital signatures, signing a DH key exchange, exchanging a key, etc.

So, a question you didn't ask, but might be thinking now:

If we learned about DH and RSA, isn't ElGamal unnecessary?

The answer is no. ElGamal has some other interesting properties and uses that a professor might still want you to learn about. ElGamal is semantically secure out of the box (RSA is only semantically secure if you have random padding). ElGamal has homomorphic properties that make it useful in applications like e-voting. You can create an elliptic curve variant of ElGamal. ElGamal also leads to a fairly simple threshold cryptosystem.

That said, I can see why some professors would skip ElGamal in an undergraduate crypto or network security course.

|improve this answer
$\endgroup$
  • 1
    $\begingroup$ IMO the homomorphic properties are the only useful property of ElGamal. For anything else I prefer DH + AES in an authenticated mode. $\endgroup$ – CodesInChaos Jul 31 '13 at 14:34
  • 1
    $\begingroup$ And DH isn't unauthenticated per-se. If you use a long term key, DH authenticates you. DH providing authentication is one of the big advantages of DH over RSA or ElGamal in my book. $\endgroup$ – CodesInChaos Jul 31 '13 at 14:37
  • $\begingroup$ @CodesInChaos I agree, with the possible exception of elliptic curves. $\endgroup$ – mikeazo Jul 31 '13 at 14:38
  • $\begingroup$ I don't get your point about ECC. EC-DH vs. EC-ElGamal is no different from DH vs. ElGamal on finite fields. Personally I use EC-DH as much as possible, only falling back to signatures or RSA when absolutely necessary. $\endgroup$ – CodesInChaos Jul 31 '13 at 14:42
  • $\begingroup$ @CodesInChaos EC-ElGamal for encryption. Another exception I might add is threshold ElGamal. But both of these are minor exceptions as they are rarely used in practice. $\endgroup$ – mikeazo Jul 31 '13 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.