Questions tagged [elgamal-encryption]
ElGamal is a public key encryption scheme with security based on the discrete logarithm problem.
326
questions
1
vote
1
answer
39
views
Range proof for elgamal ciphertext
Alice has an ElGamal public key $y=g^x$. Bob encrypts a value $g^b$ based on Alice's Elgamal public key and he ends up with a ciphertext $(g^by^r, g^r)$. Can Bob prove that the value $b$ is in some ...
1
vote
0
answers
59
views
Can I prove that from a set of ciphertexts one is encrypting $g^0$ and the others are encrypting $g^b$ where $b$ is a negative value?
Consider for example this set of encrypted values under the Elgamal keys $y_0$,$y_1$,$y_2$: $$
Enc_{y0}(g^0),Enc_{y1}(g^{-20}),Enc_{y2}(g^{-10})
$$
Can I prove that one value is $g^0$ and the others ...
1
vote
0
answers
47
views
How to decrypt a homomorphically modified ciphertext in Elgamal cryptosystem?
From the wiki, we know that to encrypt a message $M$ using Elgmal encryption, one should firstly map the message $M$ to an element $m$ of G using a reversible mapping function, then run the ElGamal ...
- 707
1
vote
2
answers
153
views
Using ElGamal instead of RSA in FDH
In RSA-FDH to sign a message $m$, we apply a hash function $H$ and then "decrypt" it using the private key $d$, so $Sign(m) = H(m)^d \mod N =: \sigma$ and then to verify, we use the public ...
- 13
0
votes
1
answer
28
views
ElGamal same private and random key attack
I'm having difficulty understanding this.
Consider two messages are encrypted using the same cyclic group of order $q$, generator $g$, private key $x$, and random parameter $y$.
The attacker knows a ...
- 21
0
votes
1
answer
30
views
ElGamal same private and random key attack
I'm having difficulty understanding this.
Consider two messages are encrypted using the same cyclic group order $q$, generator $g$, private key $x$, and random parameter $y$.
The attacker knows a ...
- 21
0
votes
1
answer
47
views
Zero Knowledge proof of correct ElGamal encryption
Suppose for $sk = x$, $pk = g^x$ we encrypt message $m$ with ElGamal encryption as $(g^r,m\cdot pk^r)$. My goal is to prove that I performed the encryption correctly, i.e. that the same $r$ is used ...
- 154
0
votes
1
answer
41
views
ElGamal-based BBS proxy re-encryption implementation?
are there any available tools/libraries that implement the idea of EIGamal-based proxy re-encryption scheme shown below? Preferably in Golang. Thank you!
Source of this picture: https://www.cs.jhu....
- 47
0
votes
0
answers
62
views
EC ElGamal multiplicatively Homomorphic
Can we make EC ElGamal have multiplicative homomorphic property?
- 1
0
votes
0
answers
34
views
Distributed key generation when all parties need to participate
Suppose $n$ parties where $t$ are honest want to perform a distributed key generation protocol. There are many existing schemes. In the simpler setting where all $n$ parties must be online, otherwise ...
- 325
0
votes
2
answers
87
views
What is a secure, modern, partially homomorphic encryption scheme?
I was reading this paper by Philippe Golle on using the homomorphic properties of ElGamal encryption to play a game of mental poker (i.e. cryptographically secure poker without a trusted third party ...
0
votes
1
answer
71
views
Could someone explain to me in simple terms why we need a large order of group G for Diffie-Hellman and what does that mean?
For El-gamal encryption, safe prime p is used such that p = 2q+1. However, can someone explain to me in simple terms why we would need in this context a large order of G and how it will contribute in ...
- 1
3
votes
1
answer
58
views
Can voters be authorities at the same time?
There is an encryption scheme where the votes are encrypted with ElGamal and the decryption key is the secret that is shared among the authorities. After everybody voted they publish their part of the ...
- 131
0
votes
0
answers
65
views
Decryption of an El Gamal re encryption mixnet
I have interest in e-voting and am currently trying to understand El Gamal re-encryption mixnet.
I understand how El Gamal encryption works and how mixnet works but what's not cristal clear for me is ...
- 11
0
votes
0
answers
36
views
Generate keypair in Swift - ElGamal
I have a problem..
I cannot generate a private / public key pair (Elgamal - p256) in SWIFT.
Do you have an example or a link to guide me please ?
I continue my research..
- 119
1
vote
1
answer
201
views
How to Prove Correct Decryption in ElGamal Cryptosystem
I am working on a project that uses ElGamal cryptography using multiplicative notation. The project is an internet voting implementation that uses the cryptosystem to encrypt the received ballots, re-...
2
votes
1
answer
114
views
Prove that Two Re-encryptions of the Same ElGamal Pair have the Same Decryptions
I'm working on an internet election system that requires the shuffling of ballots accompanied by an interactive proof of the legitimacy of the shuffle. I am working on this paper and I am stuck at the ...
2
votes
0
answers
72
views
ElGamal with elliptic curves and semantic security
To encrypt a group element $P$ with public key $K$ and randomness $r$ using ElGamal on elliptic curves with base point $G$ we do the following $(c_1, c_2) = (r\cdot G; P+r\cdot K)$.
When we want to ...
- 390
0
votes
0
answers
125
views
Using GP/PARI how would you solve this randomised Elgamal question?
I know how to solve this question manually, but I don't know how to solve it using the program gp/pari. It is based on randomised Elgamal
Let p = 739. Given the following ciphertext of some message m1 ...
- 1
0
votes
1
answer
71
views
ElGamal, message > p
Assume that we have:
p = 89
g = 5
public key: 17
private key: 73
If we try to encrypt message M = 53 (M < p), then we get (c1, c2) == (55, 67) and further ...
- 101
0
votes
1
answer
143
views
Decrypting a ciphertext in ElGamal's cryptosystem
I am a student in computer science currently working on a problem set in cryptography (practical problem but stuck on the math part).
Basically, suppose we receive a message that has been encrypted ...
- 1
1
vote
1
answer
149
views
Understanding Practical Differences Between ElGamal and Diffie-Hellman
I've been tasked with building a Web Assembly site that implements E2EE. I was thinking of using ElGamal Encryption to encrypt the message and Diffie-Hellman to establish the key. After doing further ...
- 11
2
votes
1
answer
64
views
What is the quadratic character of the field over which elliptic curve is defined?
I'm trying to understand the injective encoding of a message to an elliptic curve point (from this paper).
However, I'm not sure what do they mean by the quadratic character of the field. Do you know ...
- 390
0
votes
0
answers
26
views
How to prove lifted ElGamal encryption with square root communication?
I'm looking for a more efficient solution to prove the correctness of multiple ciphertexts sent to different parties are correct.
The background is that $P_i$ uses lifted ElGamal encryption to encrypt ...
0
votes
1
answer
93
views
Decryption of ElGamal ciphertext
If someone says that the decryption of an ElGamal ciphertext is "x", how can I be sure that the real value is "x" and not "y", even if he is the owner of the respective ...
- 515
0
votes
0
answers
26
views
Group Signature by Camenisch and Stadler
Page 8, Paper: "Efficient Group Signature Schemes for Large Groups" by Camenisch and Stadler
(1)
I was trying to understand membership certificate part. I am have only basic knowledge of ...
- 141
0
votes
1
answer
129
views
malleability of the Elgamal cryptosystem
In bidding for a contract, a company might outbid its competitor by simply multiplying its rival company’s encrypted bid by 0.9, without even knowing the bid. Now Suppose we are given the ciphertext c ...
- 11
1
vote
1
answer
46
views
Short randomness in ElGamal and Paillier
In the Paillier cryptosystem the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$.
My question is, what if short (E.g. 512bits) $r$ is used? ...
- 77
0
votes
1
answer
66
views
Can I use a certificate authority with Elgamal encryption?
Can I use a certificate authority with Elgamal encryption? Is this type of keys in CA?
3
votes
1
answer
124
views
Asymmetric encryption scheme with the shortest output for encrypting 1 byte of information
Imagine that one needs to periodically encrypt very short messages (i.e., a boolean Yes/No, a single byte, or 3-4 bytes in the worst case). We assume that there is no session, and we just need to ...
- 212
3
votes
3
answers
212
views
How to calculate the n in n-bit security of a crypto algorithm?
I think I'm likely missing the term because searching for this is coming up with not so precise results. I'm looking to calculate the n-bit security of say Paillier vs ElGamal vs EC ElGamal, when I ...
- 155
2
votes
1
answer
124
views
Paillier versus Lifted ElGamal for homomorphic addition for e-voting
I'm looking to create an anonymous e-Voting system which will assign a certain number of bits to each candidate during a vote, e.g. 010000 for Alice, 000100 for Bob, and 000001 for Charlie. It works ...
- 155
1
vote
1
answer
37
views
How are the points computed in the ElGamal elliptic curve encryption algorithm?
I was looking at an example of the ElGamal encryption operation here (page 24), but I can't seem to understand why:
$$\beta = 3(10, 3) = (10, 8)$$
- 13
0
votes
2
answers
85
views
ElGamal and Pailler combined
currently I am working on some secure accounting application. I have few requirements:
Application should store items which can be searched by name.
Every item has price and tax.
Every invoice ...
- 1
1
vote
0
answers
71
views
Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form
I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
0
votes
0
answers
38
views
Difficult to guess the targeted receiver
The protocol is defined as :
Bob want to send message to one of his friends say $k$ friends , he does not want his others friends (except one whom he want to send message ) to tell who is targeted ...
- 49
0
votes
0
answers
87
views
Can you obtain private key d and compute plaintext from El-Gamal?
Given an Elgamal encryption scheme with public parameters $k_{pub}=(p,\alpha,\beta)$ and an unknown private key $k_{pr}=d$.
Due to an erroneous implementation of the random number generator of the ...
- 31
1
vote
0
answers
218
views
Zero-knowledge proof of knowledge of a plaintext in exponential ElGamal
Consider the exponential ElGamal cryptosystem over some group $G$ with generator $g$. Let $m$ be a plaintext, and $(R, C) = (g^r, g^m \cdot y^r)$ an encryption thereof for some public key $y$.
Assume ...
- 371
0
votes
0
answers
177
views
Zero Knowledge Proof: Prove correct ElGamal encryption without leaking message
I know it is possible to prove zero knowledge that a given ElGamal ciphertext $(c,d)$ encrypts a plaintext belonging to some set ($\{0,1\}$ is frequently used for electronic voting applications).
Next ...
- 53
0
votes
1
answer
96
views
Modified ElGamal encryption (ElGamal encryption with messages in the exponent ) is implemented in a pairing friendly elliptic curve. Is it secure?
In my scenario, I need to distinguish if the encrypted message is 0 or not. The message is encrypted by Elgamal encryption but with the message in the exponent. i.e. $(C,R)=(g^my^r,g^r)$ where $y$ is ...
- 35
1
vote
1
answer
120
views
ElGamal Encryption over a Subgroup
Say for instance we are encrypting over a subgroup of ($Z_{67}^*, \bmod 67$).
To perform a round of El Gamal's encryption scheme we should:
Choose a subgroup of ($Z_{67}^*, \bmod 67$), of prime order....
- 31
0
votes
2
answers
245
views
Given ciphertexts C1, C2 of different messages P1 and P2; how can we prove that both C1 and C2 were encrypted using public keys of the same pair?
I vaguely recall reading about a scheme that accomplished this but am not able to figure out which one it was. For the sake of brevity I'm gonna omit any nonces.
Let's say we have an asymmetric ...
- 75
0
votes
0
answers
91
views
Request for a zero-knowledge proof (or hint)
I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key.
More ...
- 1
1
vote
1
answer
264
views
ElGamal encryption of concatenated messages
Suppose an encrypter separately produces three ElGamal ciphertexts $c_1 = E(m_1)$, $c_2 = E(m_2)$ and $c_3 = E(m_3)$, which encrypt the messages $m_1$, $m_2$ and $m_3$, respectively.
Is it possible ...
- 515
0
votes
0
answers
75
views
ElGamal variant Encryption scheme
I was asked about the following variant of $ElGamal$ Encryption Scheme (Preparing for exam):
Instead of encrypting $(g^r,h^r*m)$, encrypt $(g^r,h^r+m)$. And the question is whether the new variant CPA ...
- 13
2
votes
1
answer
409
views
Python library that implements additive homomorphism of Elgamal Encryption on the Elliptic curve i.e X25519 or P-256
I'm trying to find a Python library that implements Elgamal Encryption on the Elliptic curve i.e X25519 or P-256.
My purpose is to use the additive homomorphic property of Elgamal.
I'm using https://...
- 21
2
votes
2
answers
176
views
ElGamal encryption security
Assume we have 2 prime numbers in form p = 2q + 1.
Is it safe to use the cyclic group of order p-1 instead of one with order <...
- 125
0
votes
0
answers
118
views
Attack on ElGamal Encryption
Bob is holding a secret-bid auction using ElGamal encryption. He chooses a “safe” prime $p$ of sufficient size, a generator $g$ in $\operatorname{QR}(\mathbb Z_p)$ and a value $b$ in $[1, p]$. He then ...
0
votes
0
answers
136
views
Is there an Elgamal implementation in javascript?
Does anyone know a good, well known implementation of ElGamal encryption and decryption in JavaScript?
I was told that Stanford Javascript Crypto Library https://github.com/bitwiseshiftleft/sjcl/ ...
- 19
0
votes
1
answer
150
views
Why Bellare-Micali Oblivious Transfer Construction requires ElGamal with hashed key?
The idea of the Bellare-Micali Oblivious Transfer Constructions is the following:
Informally, the receiver is required to generate two public keys $y_b$, $y_{b-1}$ such that it knows only the secret ...
- 67