Questions tagged [elgamal-encryption]

ElGamal is a public key encryption scheme with security based on the discrete logarithm problem.

Filter by
Sorted by
Tagged with
1 vote
0 answers
27 views

Dealing with MITM attack in e-voting systems

I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers. -Does anyone knows ...
ShAr's user avatar
  • 152
0 votes
0 answers
54 views

ElGamal signature scheme problem and unsure whether my calculations are wrong or that's the answer

Trying to solve problem with verifying a message through the ElGamal signature scheme and I end up getting two different values. I'm given a prime number p=881 , e1=3, d=60 , and a random value r=11 . ...
Justin B's user avatar
0 votes
1 answer
61 views

Is ElGamal secure if we fix the generator for all users?

In the ElGamal cipher, the key generation algorithm needs to randomly sample a generator g and test whether g is a safe generator or not each time. I wonder whether we can use a fixed safe generator ...
Saint Gold's user avatar
1 vote
1 answer
81 views

Why exclude the last group element when picking Elgamal secret key

Christof Paar explains in his lectures that Elgamal encryption scheme picks the private key from $\{2, \ldots, p-2\}$, is there a reason for excluding the last and first elements?
synack's user avatar
  • 123
1 vote
0 answers
27 views

Efficient oblivous test of plaintext equality for pairs of sets

Suppose we have two sets of ElGamal cipher texts encrypted with the same public key $y$ in a prime order group: $C_i = (g^{r_i}, a_i y^{r_i}) $ for $ i \in \{1 ... n\}$ and $D_j = (g^{s_j}, b_j y^{s_i}...
drydrydesert's user avatar
2 votes
0 answers
127 views

Equality of ElGamal plaintext & Pedersen commitment message

Let's imagine two entities: Bob and Alice. Bob's public key is $B = bG$. Alice's public key is $A = aG$. Alice encrypts her number $n$ with Bob's public key so Bob could decrypt it ($n$ is small ...
Seed Barret's user avatar
1 vote
1 answer
57 views

Why modified version of ElGamal is used on JCJ e-voting scheme?

I was reading the Coercion-Resistant Electronic Election paper and don't understand why the authors chose a modified version of ElGamal. I guess that it was for security reasons. If so, what are the ...
Alexander Vidaurre Arroyo's user avatar
2 votes
1 answer
119 views

How to prove the correct decryption of several (ElGamal) ciphertexts in a batch?

I know how to prove the correct decryption of a (ElGamal) ciphertext. The above protocol is from the paper: Bootle J, Cerulli A, Chaidos P, et al. Short accountable ring signatures based on DDH[C]//...
user109993's user avatar
0 votes
2 answers
103 views

Hiding property of Elgamal-like bit commitment

An Elgamal-like bit commitment scheme: Let $\langle g \rangle$ be a group of order $n$, where $n$ is a large prime. Let $h\in_{R}\langle g \rangle\setminus\{1\}$ denotes a random group element such ...
user1035648's user avatar
2 votes
1 answer
67 views

What is the space that exponents of ElGamal encryption scheme live?

It is a bit stupid question, but I am so confused. Please examine my explanation. What is the space that exponents the generator $g$ of a cyclic group $G$ of prime order $p$? I think it is $\mathbb{Z}...
Lee Seungwoo's user avatar
3 votes
0 answers
59 views

Text to Divisor Class Encoding in Hyperelliptic Curve Cryptography

When trying to implement ElGamal Public Key Encryption using Hyperelliptic Curves, one needs to map the message that will be encrypted to a valid Divisor (in my case in the Mumford representation, ...
PanosDgs's user avatar
2 votes
0 answers
66 views

To prove equality/inequality of plaintexts of 2 ciphertexts encypted under different encryption schemes

We have 2 ciphertexts, one encrypted using Paillier and another encrypted under Elgamal encryption schemes. Is there a way to design ZK-proof to prove equality of the underlying plaintexts of these 2 ...
G Pavithra 's user avatar
2 votes
1 answer
107 views

What bitlength should I use for generating primes for a ElGamal Encryption Cyclic Group (given the data to encrypt has a short time-value vector)?

I am generating large prime numbers to create a cyclic group for ElGamal encryption, I can specify the bit-length n but want to limit the size because this will ultimately allow me to limit the amount ...
Poseidon's user avatar
3 votes
0 answers
24 views

Anonymized Spatial Conflict Assessment - Suggested Approaches?

Scenario: There are 3 people: PERSON1, PERSON2, and PERSON3 PERSON1 and PERSON2 each have a 2-dimensional polygon on an x,y plane It is PERSON3's job to assess whether the polygons overlap However, ...
iwatanab's user avatar
3 votes
0 answers
102 views

Dynamic Distributed Key Generation for elGamal

I am looking for a scheme for dynamic threshold public-key encryption, which includes dynamic distributed key generation. Namely, the number of parties that participate in DKG is bounded, but unknown. ...
Stanislaw Baranski's user avatar
1 vote
0 answers
48 views

Elliptic curve ElGamal cryptosystems [closed]

I have been working through a book on cryptography and have recently come across elliptic curves. This particular question has me stumped and the book isn't much help, unfortunately. I was wondering ...
Des_lat's user avatar
  • 41
3 votes
0 answers
118 views

Solving DDH from an ElGamal adversary

Suppose an adversary wins IND-CPA against ElGamal, They're given public key $h=g^x$, Give a pair of messages $m = [m0,m1]$, Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$, from which ...
bs-'s user avatar
  • 83
2 votes
2 answers
167 views

Proving same value in ciphertext and Pedersen commitment Using Sigma Zero Knowledge

Let we have 2 generator $G$ and $H$ in any elliptic curve. A prover creates a ciphertext with Homomorphic ElGamal, $(r_1G,\;mG + r_1P)$ such that $r_1$ is random and $P$ is public key of the prover. ...
midmotor's user avatar
2 votes
0 answers
54 views

Proxy Re-Encryption based on standard ElGamal

ElGamal-based BBS proxy re-encryption is well known, but it works on a variant of ElGamal like ($mg^r$,$g^{xr})$ not standard ElGamal ($g^r$,$mg^{xr}$). After reading the original paper, I found the ...
werthy's user avatar
  • 21
1 vote
0 answers
42 views

Using exponential elgemal on ecc to encrypt and aggregate binary values

I am trying to implement an electronic voting scheme which uses the exponential version of elgamal cryptosystem, voters encrypt their votes for each candidate and send them all to the ballot box. Now ...
sepehr damavandi's user avatar
2 votes
1 answer
123 views

How does this libgcrypt elgamal decryption work?

Update: The question below was asked before I realized that this is being done to prevent a side channel attack: https://github.com/advisories/GHSA-5p8v-2xvp-pwmc What I am still curious about, is the ...
Derek's user avatar
  • 155
0 votes
0 answers
104 views

Is there a special limit in the range of the hash function?

Is there a special limit in the range of the hash function? More specifically, is it possible that there is a cryptographic hash function that outputs c-membered subsets of the n-membered set? In ...
ali alizade's user avatar
1 vote
0 answers
109 views

Are real-or-random model and LR-model are equivalent?

Are real-or-random(rr) model and LR-model are equivalent? In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent. Here is ...
Lee Seungwoo's user avatar
2 votes
2 answers
240 views

Zero secret key in EC ElGamal: standards vs theory

I'm a bit confused by the standards and some replies regarding zero (the point at infinity) in elliptic curves ElGamal. TL;DR: Why do some people recommend excluding zero? It has nothing to do with ...
pintor's user avatar
  • 548
1 vote
1 answer
88 views

Is it possible to use Batching with any of the Partial Homomorphic Cryptosystems?

I'm familiar with the concept of batching in the context of (Fully) Homomorphic Encryption - whereby many values can be encrypted as a single ciphertext and operated on simultaneously in an SIMD/...
slickboy's user avatar
  • 177
1 vote
0 answers
70 views

On a public e-voting, how do I keep the votes from being disclosed prematurely without a trustee?

I am trying1 to build a Proof Of Concept of a e-voting scheme on a blockchain. Before the elaboration, the question: On a public e-voting, how do I keep the votes from being disclosed prematurely ...
desertkun's user avatar
0 votes
0 answers
120 views

ElGamal cryptosystem

ElGamal cryptosystem provides multiplicative homomorphic property which can also be converted to additive homomorphic property. Can we use both properties simultaneously? For example, we want to ...
A_guest's user avatar
0 votes
0 answers
115 views

How to reduce Diffie Hellman problem to ElGamal?

I'm trying to answer without success questions (ii - iv) Any hint will be appreciated :)
Facundo Fleitas's user avatar
2 votes
1 answer
310 views

Range proof for ElGamal ciphertext

Alice has an ElGamal public key $y=g^x$. Bob encrypts a value $g^b$ based on Alice's Elgamal public key and he ends up with a ciphertext $(g^by^r, g^r)$. Can Bob prove that the value $b$ is in some ...
Μενέλαος Κοκάρας's user avatar
1 vote
0 answers
99 views

Can I prove that from a set of ciphertexts one is encrypting $g^0$ and the others are encrypting $g^b$ where $b$ is a negative value?

Consider for example this set of encrypted values under the Elgamal keys $y_0$,$y_1$,$y_2$: $$ Enc_{y0}(g^0),Enc_{y1}(g^{-20}),Enc_{y2}(g^{-10}) $$ Can I prove that one value is $g^0$ and the others ...
Μενέλαος Κοκάρας's user avatar
1 vote
0 answers
115 views

How to decrypt a homomorphically modified ciphertext in Elgamal cryptosystem?

From the wiki, we know that to encrypt a message $M$ using Elgmal encryption, one should firstly map the message $M$ to an element $m$ of G using a reversible mapping function, then run the ElGamal ...
user77340's user avatar
  • 787
1 vote
2 answers
235 views

Using ElGamal instead of RSA in FDH

In RSA-FDH to sign a message $m$, we apply a hash function $H$ and then "decrypt" it using the private key $d$, so $Sign(m) = H(m)^d \mod N =: \sigma$ and then to verify, we use the public ...
mrwarrdy's user avatar
0 votes
1 answer
75 views

ElGamal same private and random key attack

I'm having difficulty understanding this. Consider two messages are encrypted using the same cyclic group of order $q$, generator $g$, private key $x$, and random parameter $y$. The attacker knows a ...
Public IP's user avatar
0 votes
1 answer
474 views

ElGamal same private and random key attack

I'm having difficulty understanding this. Consider two messages are encrypted using the same cyclic group order $q$, generator $g$, private key $x$, and random parameter $y$. The attacker knows a ...
Public IP's user avatar
1 vote
1 answer
560 views

Zero Knowledge proof of correct ElGamal encryption

Suppose for $sk = x$, $pk = g^x$ we encrypt message $m$ with ElGamal encryption as $(g^r,m\cdot pk^r)$. My goal is to prove that I performed the encryption correctly, i.e. that the same $r$ is used ...
Panos's user avatar
  • 314
1 vote
1 answer
296 views

ElGamal-based BBS proxy re-encryption implementation?

are there any available tools/libraries that implement the idea of EIGamal-based proxy re-encryption scheme shown below? Preferably in Golang. Thank you! Source of this picture: https://www.cs.jhu....
Leo's user avatar
  • 89
0 votes
0 answers
142 views

EC ElGamal multiplicatively Homomorphic

Can we make EC ElGamal have multiplicative homomorphic property?
jeljeli's user avatar
1 vote
0 answers
54 views

Distributed key generation when all parties need to participate

Suppose $n$ parties where $t$ are honest want to perform a distributed key generation protocol. There are many existing schemes. In the simpler setting where all $n$ parties must be online, otherwise ...
lamba's user avatar
  • 1,365
1 vote
2 answers
238 views

What is a secure, modern, partially homomorphic encryption scheme?

I was reading this paper by Philippe Golle on using the homomorphic properties of ElGamal encryption to play a game of mental poker (i.e. cryptographically secure poker without a trusted third party ...
user3450456's user avatar
1 vote
1 answer
171 views

Could someone explain to me, in simple terms, why we need a large order of group G for Diffie-Hellman and what does that mean?

For ElGamal encryption, safe prime $p$ is used such that $p = 2q+1$. However, can someone explain to me, in simple terms, why we would need, in this context, a large order of $G$ and how it will ...
Zod's user avatar
  • 11
4 votes
1 answer
85 views

Can voters be authorities at the same time?

There is an encryption scheme where the votes are encrypted with ElGamal and the decryption key is the secret that is shared among the authorities. After everybody voted they publish their part of the ...
New2Math's user avatar
  • 141
0 votes
0 answers
132 views

Decryption of an El Gamal re encryption mixnet

I have interest in e-voting and am currently trying to understand El Gamal re-encryption mixnet. I understand how El Gamal encryption works and how mixnet works but what's not cristal clear for me is ...
Xavier's user avatar
  • 11
1 vote
1 answer
505 views

How to Prove Correct Decryption in ElGamal Cryptosystem

I am working on a project that uses ElGamal cryptography using multiplicative notation. The project is an internet voting implementation that uses the cryptosystem to encrypt the received ballots, re-...
Andrei Florian's user avatar
2 votes
1 answer
131 views

Prove that Two Re-encryptions of the Same ElGamal Pair have the Same Decryptions

I'm working on an internet election system that requires the shuffling of ballots accompanied by an interactive proof of the legitimacy of the shuffle. I am working on this paper and I am stuck at the ...
Andrei Florian's user avatar
2 votes
0 answers
107 views

ElGamal with elliptic curves and semantic security

To encrypt a group element $P$ with public key $K$ and randomness $r$ using ElGamal on elliptic curves with base point $G$ we do the following $(c_1, c_2) = (r\cdot G; P+r\cdot K)$. When we want to ...
pintor's user avatar
  • 548
0 votes
0 answers
255 views

Using GP/PARI how would you solve this randomised Elgamal question?

I know how to solve this question manually, but I don't know how to solve it using the program gp/pari. It is based on randomised Elgamal Let p = 739. Given the following ciphertext of some message m1 ...
Sarah's user avatar
  • 1
0 votes
1 answer
132 views

ElGamal, message > p

Assume that we have: p = 89 g = 5 public key: 17 private key: 73 If we try to encrypt message M = 53 (M < p), then we get (c1, c2) == (55, 67) and further ...
DBenson's user avatar
  • 101
2 votes
1 answer
360 views

Decrypting a ciphertext in ElGamal's cryptosystem

I am a student in computer science currently working on a problem set in cryptography (practical problem but stuck on the math part). Basically, suppose we receive a message that has been encrypted ...
seboll13's user avatar
1 vote
1 answer
422 views

Understanding Practical Differences Between ElGamal and Diffie-Hellman

I've been tasked with building a Web Assembly site that implements E2EE. I was thinking of using ElGamal Encryption to encrypt the message and Diffie-Hellman to establish the key. After doing further ...
Davis's user avatar
  • 11
2 votes
1 answer
78 views

What is the quadratic character of the field over which elliptic curve is defined?

I'm trying to understand the injective encoding of a message to an elliptic curve point (from this paper). However, I'm not sure what do they mean by the quadratic character of the field. Do you know ...
pintor's user avatar
  • 548

1
2 3 4 5
8