# Questions tagged [elgamal-encryption]

ElGamal is a public key encryption scheme with security based on the discrete logarithm problem.

309 questions
Filter by
Sorted by
Tagged with
612 views

### ElGamal cipher decryption (reposted not from guest account)

My sincerest apologies for having to repost this but I can't edit or post a comment from the previous one I asked with a guest account. I'm learning about the Diffie-Hellman and ElGamal ciphers, but ...
360 views

### How do i avoid random output in ECIES encryption and Elgamal encryption as well?

I have a case where to ensure the same encrypted string for the given input. Say for example If "Hello" is encrypted more than one time then same encrypted string should be i should get as an output (...
2k views

### ElGamal: Why is reusing the same $k$ not secure?

I have a question on the encryption process of ElGamal:  Y = g ^ a \bmod p \\ C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\ D = m \cdot y ^ k \bmod p \\ \text{Decryption:}\...
1k views

### How is a re-encryption done with elGamal?

For example, the "Mental poker" protocol asks for Bob to encrypt each card with his key, shuffle them, and then pass them to Alice. Alice then encrypts each card with HER key, shuffles them, and then ...
214 views

### Show how to create a legal encryption without knowing their decryption [closed]

Given El-Gamal encryption system. 1) Show how to create a new legal encryption from two different encryptions which we don't know their decryption. 2) Show how an enemy can exploit the previous ...
621 views

### El-Gamal Given C1=E(m) how to create C2 such the D(C2)=m [closed]

El Gamal cipher is not defined to be one-to-one because the ciphertext depends on a random k(key) value. Show that given a ciphertext C1=E(m) we can create a different encrypted copy which can be ...
4k views

400 views

### Is 2 a safe generator for elgamal encryption

From what I understand here https://en.wikipedia.org/wiki/ElGamal_encryption and here: https://ritter.vg/security_adventures_elgamal.html, any number can be used as a generator. Is there something ...
356 views

### Discrete logarithm problem in subgroup of index 2. ElGamal

I need some insight for the following problem in ElGamal encryption procedure. It is stated that ElGamal problem in a group $\mathbb{Z}_p^*$ becomes easier in subgroups. Assume I have a subgroup of ...
266 views

### Time gap between Diffie-Hellman Key Exchange and ElGamal encryption?

I'm looking into the Diffie-Hellman key exchange paper (New Directions in Cryptography, 1976) as part of a series of classic papers in Cryptography for my Ph.D and I was wondering if someone could ...
2k views

### Why is it claimed that ElGamal is worse than RSA?

I have some notes that claim that ElGamal is worse than RSA in the sense that ElGamal is length-increasing. Do anybody know what this means and why is a bad property? Edit: For completeness I show ...
287 views

Is the encryption function of the ElGamal public-key cipher time-varying?
2k views

### Comparing two encrypted numbers using El Gamal without using decryption

I'm trying to create a protocol for comparing two El Gamal encrypted numbers (both numbers are encrypted with the same public key). However I'm having trouble with figuring out how to do this without ...
1k views

### ElGamal malleability for a given function f(m)

Given the function $f(m)=m^3$, where $m$ is a plaintext message, what is a function for which ElGamal would be malleable to produce $f(m)$. I know for $t * c_2$ that this would yield $t * m$ but I ...
349 views

### What is the correct test/s to do in asymmetric algorithms to test their security?

I would do some test for evaluating security in asymmetric algorithms such as RSA and ElGamal to evaluate which of both are safer. The basic problem is that I need to test the security of some ...
537 views

### Easy to implement proof of shuffle

I will be writing some code to implement a non interactive proof of shuffle. I intend to use it on a voting application that supports Borda voting. The voter must prove that her vote is valid, that is ...
251 views

### Oblivious Polynomial Evaluation and Encoding Payload

I am trying to parse this paper. I think I do come to understand the general concepts go into this type of Private Set Intersection, based on Oblivious Polynomial Evaluation. I was able to produce a ...
309 views

443 views

### Getting a key size of DSA/Elgamal certificate

I've tried to get a public key size of DSA/Elgamal PGP certificate. Using the Cleopatra I find out that there is actually two public keys - one with DSA with key ...
169 views

### El Gamal special construction

The algorithm: I have to determine if the following algorithm is secure: $p,q \in \mathbb{P}$ and $N = p \cdot q$ $e \in [2, N - 1]$ such that $\gcd(e, N) = 1$ $r_1, r_2$ are random numbers in ...
700 views

### Is ElGamal encryption still secure if the randomness is known to be even?

In ElGamal encryption $(g^r, g^mg^{kr})$, if the randomness $r$ is always chosen from even numbers, and the attacker knows about this, is it still provable secure?
359 views

### Elgamal with secret key equal to zero possible?

From various sources (e.g. this paper, page 3), the key generation algorithm of Elgamal samples the secret key $x$ from $\mathbb{Z}_q$, which is identifiable to $\{0, 1, 2, \dots, q-1\}$. My ...
325 views

### Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does ...
320 views

### ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal. I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$
428 views

725 views

### How to find element g order q, given 2 large primes p and q where q|p-1

i have calculated 2 large primes, $p$ (minimum 2048 bits) and $q$ (minimum 224 bits), where $p-1 \mod q = 0$ by using SageMath. $p =$...
797 views

### Why do the subexponential algoriths for the DLP not work for the ECDLP?

Elliptic curve cryptography is much more secure for the same parameters because attacks that work on the DLP do not work on the ECDLP. Why do the attacks fail in the latter case?
590 views

### Is there an additive homomorphic encryption that supports exponentation

For example say we have two numbers a and b. Now is there any partial homomorphic encryption scheme that allows to compute (a-b)^2 over the ciphertexts of a and b without round trips.
1k views

### Elliptic curve ElGamal with homomorphic mapping

I am interested in ElGamal due to the fact that you can achieve some degree of homomorphic properties. I became interested in applying ElGamal to elliptic curves, and found this other question with an ...
142 views

### An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
193 views

### Elliptic ElGamal Public Key Cryptosystem doubt

I need an example of Elliptic ElGamal Public Key Cryptosystem. I have been trying with some values but I don't get the right solution. I have $p=13$, the elliptic curve $E:y^2=x^3+11x+7$ and a point ...
190 views

### Which values are used for an elgamal cryptosystem public key?

I know that – within the elgamal cryptosystem – the values of $a$ and $b$ are public. But which values are used to create public keys?
4k views

### How is El Gamal different from Diffie Hellman Key Exchange [duplicate]

I am Reading RSA and Public-Key Cryptography by Mollin and I can't make out how El Gamal is different from Diffie Hellman Key Exchange. Any thoughts?
265 views

### ElGamal in a different group

Can Elgamal be secure in $\bmod {n^2}$? Meaning instead of using a prime order group to use a group where DCR assumption holds?
1k views

### Random Coin Flip

Quoting an old question: Consider the following protocol for two parties A and B to flip a fair coin (more complicated versions of this might be used for Internet gambling): A trusted ...
697 views

### How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
454 views

### How to compare the efficiency of public key cryptosystems, i.e., RSA vs El Gamal?

As part of my Mathematics degree I'm taking a Discrete Mathematics module which partially covers Public Key Cryptography but does not at all enter it in depth. I'm currently working on a project that ...
803 views

### How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
405 views

### ElGamal Signatures

I know various applications of RSA signatures. I wonder, is there any real-world applications of ElGamal signatures and encryption?
105 views

### Batch ElGamal Scheme

I know about ElGamal scheme and its key generation, encryption, and decryption methods. I'm not sure about what is meant by batch ElGamal. Can someone please clarify it. How it differs from ElGamal ...
### Do $v_1=\alpha\cdot r_1$ and $v_2=\alpha\cdot r_2$ leak information about $\alpha$
Please consider we have finite field $\mathbb{F}_p$ for large prime number $p$. We have a fixed field element $\alpha$. By $r_i\leftarrow \mathbb{F}_p$ we mean we pick $r_i$ uniformly random from the ...