0
$\begingroup$

If someone says that the decryption of an ElGamal ciphertext is "x", how can I be sure that the real value is "x" and not "y", even if he is the owner of the respective private key?

$\endgroup$
0
$\begingroup$

Assuming you are using El Gamal encryption in a group where the decisional Diffie-Hellman problem is hard, you cannot. El Gamal is known to be IND-CPA in such groups.

If DDH is tractable and they assert that the cryptogram $(n,c)$ is of the form $(g^r,xa^r)$ then you can check $\mathrm{DDH}(g,a,n,c/x)$.

You can ask for additional information to prove their assertion, but this exceeds the parameters of your question.

$\endgroup$
1
  • $\begingroup$ This is about commitment or zero-knowledge. $\endgroup$
    – kelalaka
    Oct 12 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.