Questions tagged [elgamal-encryption]
ElGamal is a public key encryption scheme with security based on the discrete logarithm problem.
275
questions
0
votes
0answers
34 views
ElGamal with massage hashed ind-cca secure?
It is well known that text book ElGamal is not IND-CCA secure, because an attacker can just have $$(Y,W)\leftarrow E_{x}(LR(M1,M2,b))$$ where M1, and M2 can be any message in the group, and than just ...
0
votes
1answer
43 views
ElGamal Decryption variant
I am trying to do some ElGamal encryption but having a different encryption formula.
For that I doing the following steps:
The key generator:
Choosing value $p = 107$ and $a = 2$
Random number $d = ...
0
votes
1answer
58 views
Elgamal Encryption: Why does Bob get to reuse his keypair while Alice has to generate a new one for every message?
From Christof Paar's book
The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes ...
2
votes
0answers
32 views
Why is confusion & diffusion not required PKI encryption schemes like Elgamal encryption?
The Elgamal encryption scheme is a Multiplicative Mask with the shared key. It doesn't seem to have any confusion or diffusion.
So why is it not necessary here as compared to Block Ciphers?
2
votes
1answer
87 views
Questions about Symmetric Encryption part of TLS
In TLS, we use DHKE for establishing the session key & then encrypt the actual communication with session key using symmetric encryption. While reading about DHKE, I learnt that you could use the ...
0
votes
0answers
46 views
0
votes
1answer
41 views
Is there a way to confirm that a homomorphic division (multiplication with inverse) using ElGamal produced the correct result?
By running some tests I observed that if I perform a homomorphic division (multiplication with the multiplicative inverse) between two values using the ElGamal scheme, I get the correct result when ...
1
vote
2answers
94 views
Adversary for attack on one variant of ElGamal
I came by the following question:
Consider the following variant of ElGamal encryption. Let $p= 2q+ 1$,
let $G$ be the group of squares modulo $p$ so $G$ is a subgroup of
$Z_p^*$ of order $q$, and ...
2
votes
1answer
60 views
How do I encrypt a long message using ElGamal encryption correctly?
According to ElGamal encryption, in order to encrypt a message I need to generate a shared secret s and after that I am to calculate ...
2
votes
1answer
167 views
Negative numbers with additive ElGamal
I'm trying to implement Private Set Intersection using the additive ElGamal public key encryption system. The code I've written can encrypt and decrypt numbers using the ElGamal system, so far so good....
0
votes
1answer
122 views
Number of operations for Elgamal cryptosystem
In page 408 of Hoffstein, Piper, and Silverman's Introduction to Mathematical Cryptography, it says
"Roughly speaking, in order to achieve $k$ bits of security,
encryption and decryption for ...
1
vote
1answer
63 views
Can Eve break this public key cryptosystem if she can solve DLP or DHP?
The PKC is in this way:
Alice and Bob fix a publicly known prime $p$, and all of the other numbers used are private (unless sent). Alice takes her message $m$, chooses a random exponent $a$, and ...
0
votes
0answers
38 views
Secure asymmetric encryption with 32byte ciphertext
I need securely asymmetrically encrypt the up to 16 bytes plaintext and receive up to 32 bytes ciphertext. I found that ElGamal produces ciphertext that is 2 times keysize. So I would need to use ...
0
votes
0answers
59 views
How can breaking the ElGamal encryption scheme break the Diffie-helman protocol?
I have been studying how ElGamal is a public-key algorithm built on top of the Diffie-Hellman key exchange but I got confused. How exactly could an attacker break the Diffie-Hellman protocol (i.e. ...
1
vote
1answer
48 views
Standard for asymmetric encryption based on elliptic curves
Most parts of public key cryptography has established standards which are in turn used in a large amount of real world applications. There is PKCS#1 for RSA based encryption and signatures and there ...
1
vote
0answers
30 views
Two ElGamal ciphertexts equivalence
Is there a way to prove that two ElGamal ciphertexts encrypt the same message with different public keys without knowing the private keys?
The prover is the producer of both ciphertexts.
4
votes
1answer
167 views
How can I prove that ElGamal encryption in $\mathbb{Z}_p^*$ with OAEP padding is ind-CPA secure?
How I can prove that ElGamal encryption in $\mathbb{Z}_p^*$ with Optimal Asymmetric Encryption Padding (OAEP) is IND-CPA secure?
0
votes
0answers
21 views
Does reusing the same $R$ in Elliptic Curve ElGamal breach its security? [duplicate]
In Elliptic Curve ElGamal if I reuse the same randomness to get the same point $R$ for different messages, how can it breach its security ?
Can you please illustrate with an example?
Please see my ...
3
votes
1answer
169 views
How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?
If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows:
...
0
votes
1answer
140 views
ElGamal Threshold Cryptosystem
Suppose we have a threshold ElGamal cryptosystem $(t, n)$ over an Elliptic Curve $E_p$, $p$ being a large prime, with the following parameters:
$G$ is a generator point of $E_p$ with order $q$
A ...
9
votes
2answers
2k views
What is largest prime factor in Diffie-Hellman?
I was reading the paper of A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms by TAHER ELGAMAL to better understand ElGamal public-key scheme, and he stated that for any ...
0
votes
0answers
197 views
What are the safe primes for $p$ and $q$ used in ElGamal?
I need to generate a 2048 bit key for ElGamal and I was looking for the $p$ and $q$ for PGP but I couldn't find them. the only thing I could find was this RFC but those are not safe primes.
Does ...
1
vote
1answer
131 views
Is it possible to perfom quadratic residues attack on elgamal cryptosystem?
I understand how this attack work on mental poker, but i am unable to see how can i apply it in Elgamal.
0
votes
1answer
85 views
Message space when using the group of QR's for El Gamal Encryption
My textbook states, that the DDH-assumption is not satisfied when we use the group
$\mathbb{Z}/p \mathbb{Z}$ and demonstrates an attack using Eulers Criterion. After that, it states that one should ...
3
votes
0answers
64 views
How to know if an ElGamal ciphertext is well-formed?
Is there a way to prove/verify that an exponential ElGamal ciphertext of a message representative $\widetilde{m}=mG$ is well-formed, meaning that $r_1 = r_2$ in:
$$C = (R, S) = (r_1G, \widetilde m + ...
0
votes
1answer
47 views
Retrieving ElGamal message with negative exponent value
Although the ElGamal scheme states that the message $M$ must be $1 \le M \le p-1$ in this paper: A Secure and Optimally Efficient
Multi-Authority Election Scheme they propose a method where the ...
0
votes
1answer
146 views
decrypting el gamal encrypted messages in regards to k being used
i am trying to understand the differences of using k in the following scenarios to better understand the protocol and most importantly the consequences of using such k.
so i wonder, some user, call ...
1
vote
1answer
102 views
EL Gamal Attack without a secret key
I have the following data where all the inputs are Big Integers,
group size $p$,
group generator $g$
public key of the receiver $y$
$c_1$ and $c_2$
Random Number as well
I am trying to execute an ...
2
votes
2answers
346 views
Construct another ciphertext that decrypts to same message without knowing key in Elgamal
I read about ElGamal from various resources and I was wondering if the following is true. Would appreciate if you could elaborate on it so I can understand better:
Is it possible to construct, given ...
6
votes
2answers
756 views
How to create an EC point from a plaintext message for encryption
It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
4
votes
0answers
157 views
Security properties of ElGamal encryption variants
I'll use Taher ElGamal's A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms (July 1985 in IEEE Transactions on Information Theory, formerly in proceedings of Crypto 1984) as ...
-1
votes
1answer
253 views
Randomness in Elgamel [closed]
Suppose that, instead of choosing r completely at random in ElGamal public key encryption, a lazy encryptor (Alice) derives it by following r′= 2r. Suppose also that Eve knows that Alice ...
1
vote
1answer
50 views
Are short ElGamal keysizes acceptable (1024-bit or lower) in cases where security is only necessary in a short timeframe
I am working on an efficient mental poker framework. I have implemented a functional and secure commutative encryption scheme based on ElGamal as described in:
http://groups.csail.mit.edu/cis/theses/...
2
votes
1answer
50 views
Does the discrete log assumption hold if k > p
In discrete log cryptosystems like ElGamal it is noted that the "private key" $k$ should be chosen as any element of the group $G$ i.e. $k < p-1$. Does the integrity of the cryptosystem rely on $k$ ...
1
vote
1answer
52 views
Retrieving correct ciphertext from additive ElGamal
I have been studying additive ElGamal and I think I have the hang of it except the part where the message $M$ must be retrieved by computing the discrete log of $g^M$.
From what I've read, the ...
1
vote
1answer
202 views
Understanding message reversible mapping function in group G
In ElGamal encryption, it says that the message M that is about to get encrypted must be mapped to its m counterpart in the group G using a reversible mapping function.
Map the message M to an ...
2
votes
1answer
119 views
Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal?
ElGamal, RSA, and Paillier cryptosystem have homomorphic property, and can be used fro re-encryption purposes. I want to use the encryption to re-encrypt ciphertext(as in proxy re-encryption but ...
0
votes
1answer
107 views
How to compute ElGamal decryption by hand
Lets say that $u=3, x=5, v=2$, how do we work out $u^{-x}*v$, so $3^{-5} * 2$. I know how to work out the answer if it was $3^5 * 2$ but how do we do it with negative exponents?
0
votes
1answer
655 views
Proving the CCA-insecurity of El Gamal encryption scheme
I am trying to prove that El Gamal Encryption is not CCA-Secure.
If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
1
vote
0answers
142 views
How can I prove that the plaintext of an elgamal ciphertext is the discrete log of an element?
Is there any (efficient) method to prove that the plaintext of an ElGamal ciphertext is the discrete log of an element?
In the scenario I concerned, I have an El Gamal key pair $(pk, sk) = (g^y, y)$....
2
votes
1answer
104 views
Post-quantum alternative to ElGamal? (public key verifiability)
Are there any alternatives to ElGamal that would be resistant/annoying to quantum machines?
I would like to preserve public key derivability/verifiability -- ability to ensure existence of ...
1
vote
0answers
51 views
ElGamal: different message with equal length random key [closed]
This situation applies to ElGamal digital signatures: consider messages m1 and m2 which we will encipher with a random key. The random key has the same Hamming weight. Is this situation secure? Why?
...
2
votes
0answers
86 views
Intuition for Cramer Shoup Encryption Scheme?
I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows.
Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, ...
2
votes
2answers
126 views
Whats wrong with my El Gamal signature example
I'm trying to digitally sign a message m using El Gamal. So far I've been unable to verify the digital signature ive made using El Gamal.
I am using prime number, p = 8369. prime root g = 3031. ...
4
votes
1answer
491 views
ECIES/ ECDHE/ EC-ElGamal encryption comparison
I need to choose an encryption system, so I am trying to understand the differences between the existing options. I always find that people compare ECIES (Elliptic Curve Integrated Encryption Scheme) ...
0
votes
1answer
47 views
How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?
To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$.
$c = mg_1^r$ mod p
If an ...
1
vote
1answer
386 views
Proof of correctness of an ElGamal encryption given a specific public key
Suppose Alice sends an ElGamal encryption of a value $v$ to Bob (using either the normal or exponential version of ElGamal). E.g. assuming publicly-known $pk_{BOB} = h$ and a generator $g$, Alice ...
0
votes
0answers
50 views
Beginners question regarding ElGamal
How to motivate, that in ElGamal Alice the recipient keeps her keys fixed, while Bob the sender changes the key each time - why not both of them change their keys each time?
2
votes
1answer
543 views
find $a$ and $k$ for a given el gamal cryptosystem
I am given this question:
Suppose Alice is using the ElGamal Signature scheme with parameters
$p = 31847$, $\alpha = 5$, and $\beta = 25703$
Assuming that we have received signed messages
$(x_1,(\...
0
votes
0answers
77 views
ElGamal re-encrypts data
I try to learn ElGamal re-encrypts scheme and I have a question about the example: How is a re-encryption done with elGamal?.
The $g$ value of Alice must be the same as $g$ value of Bob or not?
And ...
