Questions tagged [elgamal-encryption]

ElGamal is a public key encryption scheme with security based on the discrete logarithm problem.

Filter by
Sorted by
Tagged with
1
vote
1answer
612 views

ElGamal cipher decryption (reposted not from guest account)

My sincerest apologies for having to repost this but I can't edit or post a comment from the previous one I asked with a guest account. I'm learning about the Diffie-Hellman and ElGamal ciphers, but ...
2
votes
1answer
360 views

How do i avoid random output in ECIES encryption and Elgamal encryption as well?

I have a case where to ensure the same encrypted string for the given input. Say for example If "Hello" is encrypted more than one time then same encrypted string should be i should get as an output (...
3
votes
1answer
2k views

ElGamal: Why is reusing the same $k$ not secure?

I have a question on the encryption process of ElGamal: $$ Y = g ^ a \bmod p \\ C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\ D = m \cdot y ^ k \bmod p \\ \text{Decryption:}\...
7
votes
2answers
1k views

How is a re-encryption done with elGamal?

For example, the "Mental poker" protocol asks for Bob to encrypt each card with his key, shuffle them, and then pass them to Alice. Alice then encrypts each card with HER key, shuffles them, and then ...
-3
votes
1answer
214 views

Show how to create a legal encryption without knowing their decryption [closed]

Given El-Gamal encryption system. 1) Show how to create a new legal encryption from two different encryptions which we don't know their decryption. 2) Show how an enemy can exploit the previous ...
-3
votes
1answer
621 views

El-Gamal Given C1=E(m) how to create C2 such the D(C2)=m [closed]

El Gamal cipher is not defined to be one-to-one because the ciphertext depends on a random k(key) value. Show that given a ciphertext C1=E(m) we can create a different encrypted copy which can be ...
3
votes
1answer
4k views

ElGamal CPA secure

I understand that if DDH (Decisional Diffie–Hellman) is hard then ElGamal is CPA secure. But I'm having confusion on what part the DDH applies to. So, given $pk=(G, g, y), y=g^x$ and $sk=(pk,x), x \...
0
votes
1answer
666 views

Hash ElGamal CCA approach

With this Elgamal variant defined below, we have covered in lecture but I do not still understand how a CCA could work against it. Is the use of the homomorphic nature of the encryption something you ...
3
votes
1answer
1k views

Zero knowledge proof for sign of message value

I am using ElGamal encryption to encrypt an integer message $m$ as, $E[m]$ = ($g^x$, $g^m.h^x$) Can I write a zero-knowledge proof to prove to a verifier that $m > 0$ ? I can create the bit ...
2
votes
0answers
104 views

Is public-key cryptography the correct choice? [closed]

I'm working on a project which requires encryption of sensitive data, with communication of said data between a mobile app and a website (via an API). I'm new to encryption and security, but my ...
1
vote
1answer
454 views

Can I prove that a message is part of a set of known messages without disclosing the message?

If Alice sends an encrypted message to Bob, how can Bob prove to Charlie that the message he received from Alice is part of a set of predefined messages, without disclosing the encryption key or the ...
0
votes
2answers
160 views

Breaking ElGammal encryption of two different mesagges

I'm stuck with the following problem on ElGammal encryption. We work on $\mathbb{Z}_{p}^*$ where $p$ is prime and we are given $p$, the generator $g$ of $\mathbb{Z}_{p}^*$ , the public key used $...
1
vote
1answer
400 views

Is 2 a safe generator for elgamal encryption

From what I understand here https://en.wikipedia.org/wiki/ElGamal_encryption and here: https://ritter.vg/security_adventures_elgamal.html, any number can be used as a generator. Is there something ...
1
vote
1answer
356 views

Discrete logarithm problem in subgroup of index 2. ElGamal

I need some insight for the following problem in ElGamal encryption procedure. It is stated that ElGamal problem in a group $\mathbb{Z}_p^*$ becomes easier in subgroups. Assume I have a subgroup of ...
5
votes
1answer
266 views

Time gap between Diffie-Hellman Key Exchange and ElGamal encryption?

I'm looking into the Diffie-Hellman key exchange paper (New Directions in Cryptography, 1976) as part of a series of classic papers in Cryptography for my Ph.D and I was wondering if someone could ...
5
votes
1answer
2k views

Why is it claimed that ElGamal is worse than RSA?

I have some notes that claim that ElGamal is worse than RSA in the sense that ElGamal is length-increasing. Do anybody know what this means and why is a bad property? Edit: For completeness I show ...
-1
votes
1answer
287 views

Question about ElGamal Encryption

Is the encryption function of the ElGamal public-key cipher time-varying?
1
vote
1answer
2k views

Comparing two encrypted numbers using El Gamal without using decryption

I'm trying to create a protocol for comparing two El Gamal encrypted numbers (both numbers are encrypted with the same public key). However I'm having trouble with figuring out how to do this without ...
0
votes
1answer
1k views

ElGamal malleability for a given function f(m)

Given the function $f(m)=m^3$, where $m$ is a plaintext message, what is a function for which ElGamal would be malleable to produce $f(m)$. I know for $t * c_2$ that this would yield $t * m $ but I ...
0
votes
2answers
349 views

What is the correct test/s to do in asymmetric algorithms to test their security?

I would do some test for evaluating security in asymmetric algorithms such as RSA and ElGamal to evaluate which of both are safer. The basic problem is that I need to test the security of some ...
2
votes
1answer
537 views

Easy to implement proof of shuffle

I will be writing some code to implement a non interactive proof of shuffle. I intend to use it on a voting application that supports Borda voting. The voter must prove that her vote is valid, that is ...
1
vote
1answer
251 views

Oblivious Polynomial Evaluation and Encoding Payload

I am trying to parse this paper. I think I do come to understand the general concepts go into this type of Private Set Intersection, based on Oblivious Polynomial Evaluation. I was able to produce a ...
0
votes
1answer
309 views

ElGamal recovering messages

If you use the same ephemeral key in Elgamal, someone can read the future messages. I have two ciphertexts $y_1=62$ and $y_2=4$. The difference between two plaintexts is $x_1-x_2=138$ how do I get $...
1
vote
1answer
808 views

How to show that any 2-round key-exchange protocol satisfying a given definition can be converted into a public-key encryption scheme?

How to show that any 2-round key-exchange protocol satisfying a given definition can be converted into a public-key encryption scheme that is CPA-secure? The given definition is as followed: ...
3
votes
1answer
1k views

One-wayness proof of Elgamal

Here in the proof of Elgemal one-wayness: Consider an adversary V that can invert random Elgamal encryptions with $ε$ probability. $V *$ : Adversary to compute the Diffie-Hellman function: On input ($...
1
vote
1answer
443 views

Getting a key size of DSA/Elgamal certificate

I've tried to get a public key size of DSA/Elgamal PGP certificate. Using the Cleopatra I find out that there is actually two public keys - one with DSA with key ...
3
votes
1answer
169 views

El Gamal special construction

The algorithm: I have to determine if the following algorithm is secure: $p,q \in \mathbb{P}$ and $N = p \cdot q$ $e \in [2, N - 1]$ such that $\gcd(e, N) = 1$ $r_1, r_2$ are random numbers in ...
5
votes
1answer
700 views

Is ElGamal encryption still secure if the randomness is known to be even?

In ElGamal encryption $(g^r, g^mg^{kr})$, if the randomness $r$ is always chosen from even numbers, and the attacker knows about this, is it still provable secure?
2
votes
1answer
359 views

Elgamal with secret key equal to zero possible?

From various sources (e.g. this paper, page 3), the key generation algorithm of Elgamal samples the secret key $x$ from $\mathbb{Z}_q$, which is identifiable to $\{0, 1, 2, \dots, q-1\}$. My ...
3
votes
1answer
325 views

Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does ...
3
votes
1answer
320 views

ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal. I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$
2
votes
1answer
428 views

How is it possible that $g^q \equiv 1 \pmod p$ for a generator g?

The context of this question is coming up with the parameters for the ElGamal encryption scheme. One of the requirements for the parameters for ElGamal is that we have primes $p$ and $q$ such that $p =...
2
votes
1answer
659 views

How to perform decryption in this single-bit PKE scheme?

Consider a cyclic group $G$ of order $q$, and let $g$ be a generator for $G$. Assume $(G, q, g)$ is public. Consider the following 1-bit public-key encryption scheme. To $generate (pk,sk)$: $x \...
0
votes
2answers
725 views

How to find element g order q, given 2 large primes p and q where q|p-1

i have calculated 2 large primes, $p$ (minimum 2048 bits) and $q$ (minimum 224 bits), where $p-1 \mod q = 0$ by using SageMath. $p = $...
3
votes
1answer
797 views

Why do the subexponential algoriths for the DLP not work for the ECDLP?

Elliptic curve cryptography is much more secure for the same parameters because attacks that work on the DLP do not work on the ECDLP. Why do the attacks fail in the latter case?
1
vote
1answer
590 views

Is there an additive homomorphic encryption that supports exponentation

For example say we have two numbers a and b. Now is there any partial homomorphic encryption scheme that allows to compute (a-b)^2 over the ciphertexts of a and b without round trips.
2
votes
1answer
1k views

Elliptic curve ElGamal with homomorphic mapping

I am interested in ElGamal due to the fact that you can achieve some degree of homomorphic properties. I became interested in applying ElGamal to elliptic curves, and found this other question with an ...
4
votes
0answers
142 views

An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
1
vote
1answer
193 views

Elliptic ElGamal Public Key Cryptosystem doubt

I need an example of Elliptic ElGamal Public Key Cryptosystem. I have been trying with some values but I don't get the right solution. I have $p=13$, the elliptic curve $E:y^2=x^3+11x+7$ and a point ...
2
votes
1answer
190 views

Which values are used for an elgamal cryptosystem public key?

I know that – within the elgamal cryptosystem – the values of $a$ and $b$ are public. But which values are used to create public keys?
3
votes
1answer
4k views

How is El Gamal different from Diffie Hellman Key Exchange [duplicate]

I am Reading RSA and Public-Key Cryptography by Mollin and I can't make out how El Gamal is different from Diffie Hellman Key Exchange. Any thoughts?
7
votes
2answers
265 views

ElGamal in a different group

Can Elgamal be secure in $\bmod {n^2}$? Meaning instead of using a prime order group to use a group where DCR assumption holds?
1
vote
2answers
1k views

Random Coin Flip

Quoting an old question: Consider the following protocol for two parties A and B to flip a fair coin (more complicated versions of this might be used for Internet gambling): A trusted ...
2
votes
1answer
697 views

How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
5
votes
1answer
454 views

How to compare the efficiency of public key cryptosystems, i.e., RSA vs El Gamal?

As part of my Mathematics degree I'm taking a Discrete Mathematics module which partially covers Public Key Cryptography but does not at all enter it in depth. I'm currently working on a project that ...
5
votes
0answers
803 views

How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
4
votes
1answer
405 views

ElGamal Signatures

I know various applications of RSA signatures. I wonder, is there any real-world applications of ElGamal signatures and encryption?
0
votes
0answers
105 views

Batch ElGamal Scheme

I know about ElGamal scheme and its key generation, encryption, and decryption methods. I'm not sure about what is meant by batch ElGamal. Can someone please clarify it. How it differs from ElGamal ...
4
votes
1answer
85 views

Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$

Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...
2
votes
1answer
390 views

Is Cramer-Shoup backdoorable?

We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem. There it was stated that finding such "secondary" private keys ...

1 2 3
4
5
7