Questions tagged [elgamal-encryption]
ElGamal is a public key encryption scheme with security based on the discrete logarithm problem.
341
questions
1
vote
0
answers
16
views
What bitlength should I use for generating primes for a ElGamal Encryption Cyclic Group (given the data to encrypt has a short time-value vector)?
I am generating large prime numbers to create a cyclic group for ElGamal encryption, I can specify the bit-length n but want to limit the size because this will ultimately allow me to limit the amount ...
- 11
3
votes
0
answers
23
views
Anonymized Spatial Conflict Assessment - Suggested Approaches?
Scenario:
There are 3 people: PERSON1, PERSON2, and PERSON3
PERSON1 and PERSON2 each have a 2-dimensional polygon on an x,y
plane
It is PERSON3's job to assess whether the polygons overlap
However, ...
- 31
2
votes
0
answers
55
views
Dynamic Distributed Key Generation for elGamal
I am looking for a scheme for dynamic threshold public-key encryption, which includes dynamic distributed key generation.
Namely, the number of parties that participate in DKG is bounded, but unknown. ...
1
vote
0
answers
34
views
Elliptic curve ElGamal cryptosystems [closed]
I have been working through a book on cryptography and have recently come across elliptic curves. This particular question has me stumped and the book isn't much help, unfortunately. I was wondering ...
- 41
3
votes
0
answers
57
views
Solving DDH from an ElGamal adversary
Suppose an adversary wins IND-CPA against ElGamal,
They're given public key $h=g^x$,
Give a pair of messages $m = [m0,m1]$,
Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$,
from which ...
- 83
2
votes
2
answers
105
views
Proving same value in ciphertext and Pedersen commitment Using Sigma Zero Knowledge
Let we have 2 generator $G$ and $H$ in any elliptic curve.
A prover creates a ciphertext with Homomorphic ElGamal, $(r_1G,\;mG + r_1P)$ such that $r_1$ is random and $P$ is public key of the prover.
...
- 65
2
votes
0
answers
41
views
Proxy Re-Encryption based on standard ElGamal
ElGamal-based BBS proxy re-encryption is well known, but it works on a variant of ElGamal like ($mg^r$,$g^{xr})$ not standard ElGamal ($g^r$,$mg^{xr}$). After reading the original paper, I found the ...
- 21
1
vote
0
answers
27
views
Using exponential elgemal on ecc to encrypt and aggregate binary values
I am trying to implement an electronic voting scheme which uses the exponential version of elgamal cryptosystem, voters encrypt their votes for each candidate and send them all to the ballot box. Now ...
2
votes
1
answer
96
views
How does this libgcrypt elgamal decryption work?
Update: The question below was asked before I realized that this is being done to prevent a side channel attack: https://github.com/advisories/GHSA-5p8v-2xvp-pwmc
What I am still curious about, is the ...
- 155
0
votes
0
answers
89
views
Is there a special limit in the range of the hash function?
Is there a special limit in the range of the hash function?
More specifically, is it possible that there is a cryptographic hash function that outputs c-membered subsets of the n-membered set?
In ...
- 21
0
votes
0
answers
65
views
Do the El Gamal Mix-Nets remove the link <ciphertext, sender's IP address>?
By "El Gamal Mix-Nets" i mean re-encryption (only) Mix-Nets.
Suppose that:
N Mix-Nets
Client: Alice
Server: Bob
Alice sends, via Mix-Nets, a message to Bob.
Questions:
is Bob able to ...
0
votes
0
answers
42
views
Are real-or-random model and LR-model are equivalent?
Are real-or-random(rr) model and LR-model are equivalent?
In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent.
Here is ...
- 171
2
votes
2
answers
172
views
Zero secret key in EC ElGamal: standards vs theory
I'm a bit confused by the standards and some replies regarding zero (the point at infinity) in elliptic curves ElGamal.
TL;DR: Why do some people recommend excluding zero? It has nothing to do with ...
- 474
1
vote
1
answer
59
views
Is it possible to use Batching with any of the Partial Homomorphic Cryptosystems?
I'm familiar with the concept of batching in the context of (Fully) Homomorphic Encryption - whereby many values can be encrypted as a single ciphertext and operated on simultaneously in an SIMD/...
- 177
0
votes
0
answers
77
views
What is the best choice of the base g in El-Gamal PKC
I have just read in a book that in El-Gamal PKC, the best choice of a base g is a number whose order in the field ($\mathbb{F}_p$) is a large prime, and added: "approximately = $\frac{p}{2}$"...
1
vote
0
answers
63
views
On a public e-voting, how do I keep the votes from being disclosed prematurely without a trustee?
I am trying1 to build a Proof Of Concept of a e-voting scheme on a blockchain. Before the elaboration, the question:
On a public e-voting, how do I keep the votes from being disclosed prematurely ...
- 71
0
votes
0
answers
92
views
ElGamal cryptosystem
ElGamal cryptosystem provides multiplicative homomorphic property which can also be converted to additive homomorphic property. Can we use both properties simultaneously? For example, we want to ...
- 1
0
votes
0
answers
91
views
How to reduce Diffie Hellman problem to ElGamal?
I'm trying to answer without success questions (ii - iv)
Any hint will be appreciated :)
2
votes
1
answer
190
views
Range proof for ElGamal ciphertext
Alice has an ElGamal public key $y=g^x$. Bob encrypts a value $g^b$ based on Alice's Elgamal public key and he ends up with a ciphertext $(g^by^r, g^r)$. Can Bob prove that the value $b$ is in some ...
1
vote
0
answers
86
views
Can I prove that from a set of ciphertexts one is encrypting $g^0$ and the others are encrypting $g^b$ where $b$ is a negative value?
Consider for example this set of encrypted values under the Elgamal keys $y_0$,$y_1$,$y_2$: $$
Enc_{y0}(g^0),Enc_{y1}(g^{-20}),Enc_{y2}(g^{-10})
$$
Can I prove that one value is $g^0$ and the others ...
1
vote
0
answers
86
views
How to decrypt a homomorphically modified ciphertext in Elgamal cryptosystem?
From the wiki, we know that to encrypt a message $M$ using Elgmal encryption, one should firstly map the message $M$ to an element $m$ of G using a reversible mapping function, then run the ElGamal ...
- 777
1
vote
2
answers
217
views
Using ElGamal instead of RSA in FDH
In RSA-FDH to sign a message $m$, we apply a hash function $H$ and then "decrypt" it using the private key $d$, so $Sign(m) = H(m)^d \mod N =: \sigma$ and then to verify, we use the public ...
- 13
0
votes
1
answer
55
views
ElGamal same private and random key attack
I'm having difficulty understanding this.
Consider two messages are encrypted using the same cyclic group of order $q$, generator $g$, private key $x$, and random parameter $y$.
The attacker knows a ...
- 21
0
votes
1
answer
315
views
ElGamal same private and random key attack
I'm having difficulty understanding this.
Consider two messages are encrypted using the same cyclic group order $q$, generator $g$, private key $x$, and random parameter $y$.
The attacker knows a ...
- 21
0
votes
1
answer
326
views
Zero Knowledge proof of correct ElGamal encryption
Suppose for $sk = x$, $pk = g^x$ we encrypt message $m$ with ElGamal encryption as $(g^r,m\cdot pk^r)$. My goal is to prove that I performed the encryption correctly, i.e. that the same $r$ is used ...
- 164
0
votes
1
answer
186
views
ElGamal-based BBS proxy re-encryption implementation?
are there any available tools/libraries that implement the idea of EIGamal-based proxy re-encryption scheme shown below? Preferably in Golang. Thank you!
Source of this picture: https://www.cs.jhu....
- 69
0
votes
0
answers
119
views
EC ElGamal multiplicatively Homomorphic
Can we make EC ElGamal have multiplicative homomorphic property?
- 1
1
vote
0
answers
50
views
Distributed key generation when all parties need to participate
Suppose $n$ parties where $t$ are honest want to perform a distributed key generation protocol. There are many existing schemes. In the simpler setting where all $n$ parties must be online, otherwise ...
- 1,363
0
votes
2
answers
167
views
What is a secure, modern, partially homomorphic encryption scheme?
I was reading this paper by Philippe Golle on using the homomorphic properties of ElGamal encryption to play a game of mental poker (i.e. cryptographically secure poker without a trusted third party ...
1
vote
1
answer
135
views
Could someone explain to me, in simple terms, why we need a large order of group G for Diffie-Hellman and what does that mean?
For ElGamal encryption, safe prime $p$ is used such that $p = 2q+1$. However, can someone explain to me, in simple terms, why we would need, in this context, a large order of $G$ and how it will ...
- 11
4
votes
1
answer
83
views
Can voters be authorities at the same time?
There is an encryption scheme where the votes are encrypted with ElGamal and the decryption key is the secret that is shared among the authorities. After everybody voted they publish their part of the ...
- 141
0
votes
0
answers
114
views
Decryption of an El Gamal re encryption mixnet
I have interest in e-voting and am currently trying to understand El Gamal re-encryption mixnet.
I understand how El Gamal encryption works and how mixnet works but what's not cristal clear for me is ...
- 11
1
vote
1
answer
363
views
How to Prove Correct Decryption in ElGamal Cryptosystem
I am working on a project that uses ElGamal cryptography using multiplicative notation. The project is an internet voting implementation that uses the cryptosystem to encrypt the received ballots, re-...
2
votes
1
answer
121
views
Prove that Two Re-encryptions of the Same ElGamal Pair have the Same Decryptions
I'm working on an internet election system that requires the shuffling of ballots accompanied by an interactive proof of the legitimacy of the shuffle. I am working on this paper and I am stuck at the ...
2
votes
0
answers
85
views
ElGamal with elliptic curves and semantic security
To encrypt a group element $P$ with public key $K$ and randomness $r$ using ElGamal on elliptic curves with base point $G$ we do the following $(c_1, c_2) = (r\cdot G; P+r\cdot K)$.
When we want to ...
- 474
0
votes
0
answers
195
views
Using GP/PARI how would you solve this randomised Elgamal question?
I know how to solve this question manually, but I don't know how to solve it using the program gp/pari. It is based on randomised Elgamal
Let p = 739. Given the following ciphertext of some message m1 ...
- 1
0
votes
1
answer
106
views
ElGamal, message > p
Assume that we have:
p = 89
g = 5
public key: 17
private key: 73
If we try to encrypt message M = 53 (M < p), then we get (c1, c2) == (55, 67) and further ...
- 101
2
votes
1
answer
206
views
Decrypting a ciphertext in ElGamal's cryptosystem
I am a student in computer science currently working on a problem set in cryptography (practical problem but stuck on the math part).
Basically, suppose we receive a message that has been encrypted ...
- 21
1
vote
1
answer
247
views
Understanding Practical Differences Between ElGamal and Diffie-Hellman
I've been tasked with building a Web Assembly site that implements E2EE. I was thinking of using ElGamal Encryption to encrypt the message and Diffie-Hellman to establish the key. After doing further ...
- 11
2
votes
1
answer
68
views
What is the quadratic character of the field over which elliptic curve is defined?
I'm trying to understand the injective encoding of a message to an elliptic curve point (from this paper).
However, I'm not sure what do they mean by the quadratic character of the field. Do you know ...
- 474
0
votes
1
answer
162
views
Decryption of ElGamal ciphertext
If someone says that the decryption of an ElGamal ciphertext is "x", how can I be sure that the real value is "x" and not "y", even if he is the owner of the respective ...
- 557
0
votes
1
answer
205
views
malleability of the Elgamal cryptosystem
In bidding for a contract, a company might outbid its competitor by simply multiplying its rival company’s encrypted bid by 0.9, without even knowing the bid. Now Suppose we are given the ciphertext c ...
- 11
1
vote
1
answer
75
views
Short randomness in ElGamal and Paillier
In the Paillier cryptosystem the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$.
My question is, what if short (E.g. 512bits) $r$ is used? ...
- 77
0
votes
1
answer
104
views
Can I use a certificate authority with Elgamal encryption?
Can I use a certificate authority with Elgamal encryption? Is this type of keys in CA?
3
votes
1
answer
171
views
Asymmetric encryption scheme with the shortest output for encrypting 1 byte of information
Imagine that one needs to periodically encrypt very short messages (i.e., a boolean Yes/No, a single byte, or 3-4 bytes in the worst case). We assume that there is no session, and we just need to ...
- 222
3
votes
3
answers
394
views
How to calculate the n in n-bit security of a crypto algorithm?
I think I'm likely missing the term because searching for this is coming up with not so precise results. I'm looking to calculate the n-bit security of say Paillier vs ElGamal vs EC ElGamal, when I ...
- 155
2
votes
1
answer
335
views
Paillier versus Lifted ElGamal for homomorphic addition for e-voting
I'm looking to create an anonymous e-Voting system which will assign a certain number of bits to each candidate during a vote, e.g. 010000 for Alice, 000100 for Bob, and 000001 for Charlie. It works ...
- 155
1
vote
1
answer
84
views
How are the points computed in the ElGamal elliptic curve encryption algorithm?
I was looking at an example of the ElGamal encryption operation here (page 24), but I can't seem to understand why:
$$\beta = 3(10, 3) = (10, 8)$$
- 113
0
votes
2
answers
119
views
ElGamal and Pailler combined
currently I am working on some secure accounting application. I have few requirements:
Application should store items which can be searched by name.
Every item has price and tax.
Every invoice ...
- 11
1
vote
0
answers
97
views
Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form
I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
