If someone says that the decryption of an ElGamal ciphertext is "x", how can I be sure that the real value is "x" and not "y", even if he is the owner of the respective private key?
1
-
$\begingroup$ Precise the context: Static/interactive? Bilinear group or not? $\endgroup$– IevgeniMar 12, 2022 at 7:15
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
Assuming you are using El Gamal encryption in a group where the decisional Diffie-Hellman problem is hard, you cannot. El Gamal is known to be IND-CPA in such groups.
If DDH is tractable and they assert that the cryptogram $(n,c)$ is of the form $(g^r,xa^r)$ then you can check $\mathrm{DDH}(g,a,n,c/x)$.
You can ask for additional information to prove their assertion, but this exceeds the parameters of your question.
-
$\begingroup$ This is about commitment or zero-knowledge. $\endgroup$– kelalakaOct 12, 2021 at 14:55