ElGamal same private and random key attack

Question

I'm having difficulty understanding this.

Consider two messages are encrypted using the same cyclic group order $q$, generator $g$, private key $x$, and random parameter $y$. The attacker knows a plaintext $m_1$ and its corresponding ciphertext $c_1=\left(r_1,s_1\right)$.

I was told that, under these circumstances, if an attacker also knows the ciphertext $c_2=\left(r_2,s_2\right)$ of another message $m_2$, they can recover $m_2$.

How is this possible? Wouldn't the attacker need to know $q$ and $g$?

Answer 1

$q$ and $g$ are usually assumed to be public knowledge - they are known as public parameters (or are part of the users' public keys).

If the same random value $y$ is used for both messages, then $r_1 = r_2 = g^y$.

Then we know that $s_1 = (r_1^x) \cdot m_1$ and $s_2 = (r_1^x) \cdot m_2$.

Thus the attacker can compute $$m_2 = \frac{s_2}{s_1}m_1$$ in the group.