4

I'll use Taher ElGamal's A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms (July 1985 in IEEE Transactions on Information Theory, formerly in proceedings of Crypto 1984) as the reference scheme.

  • Public parameters are a large prime $p$ with $p-1$ having at least one large prime factor, and a generator $\alpha$.
  • Long-term (public, private) key pair for receiver Bob is $(y_B,x_B)$ with random secret $x_B$ and $y_B=\alpha^{x_B}\bmod p$.
  • Message $m$ is in $[0,p)$. Sender draws random $k$, computes $K={y_B}^k\bmod p$, $c_1=\alpha^k\bmod p$, $c_2=Km\bmod p$. The ciphertext is $(c_1,c_2)$.
  • Receiver Bob accepts ciphertext $(c_1,c_2)$ in $[0,p)^2$, computes $K={c_1}^{x_B}\bmod p$, and $m=K^{-1}c_2\bmod p$.

As is, the scheme is not IND-CPA secure. For a start, $m=0\iff c_2=0$, which is easily fixed by using $\Bbb Z_p^*$ as the message space; assume that.

Another issue breaking IND-CPA is that the Legendre symbol $\displaystyle\biggl(\frac m p\biggr)$ can be found from $(p,\alpha,y_B,c_1,c_2)$, leaking one bit of information about $m$.

What has been devised to fix that, and how are the modified encryption schemes named? What security property and argument do we have for these?

I'm in particular interested by variants where

  1. $m$ is restricted to $\displaystyle\biggl(\frac m p\biggr)=+1$ by altering some bits of $m$ by trial and error.
  2. some field of $m$ is randomized (e.g. highest-order bit set to 0, next high-order $b$ bits per-encryption randomness, where $b$ is a security parameter).
  3. $m$ is a bitstring shorter than $p$ by $b$ bits; $K$ is truncated to $\tilde K$ of that size, keeping low-order bits; and $c_2=m\oplus\tilde K$ for encryption, $m=c_2\oplus\tilde K$ for decryption.
  4. as 3 above with $\tilde K$ further split into $K_i\mathbin\| K_e$, $K_i$ used as key for a Carter-Wegman hash preventing decryption of falsified ciphertexts, and $K_e$ the key for XOR-encryption of a message $m$ restricted to the corresponding size.
fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • What's the motivation? Usually Elgamal encryption only figures into fancy zero-knowledge proof systems (like Swiss vote forgery systems) requiring the homomorphic properties. If you used $\tilde K = H(K)$ for a hash function $H$ instead of mere truncation, what you get is essentially the KEM/DEM composition or IES with standard IND-CCA2 security. (DEM is basically one-time authenticated encryption, so there is no need even for Carter–Wegman; using $\tilde K$ for OTP & GMS auth is enough.) Maybe truncation is close enough to uniform random to obviate the need for hashing, I dunno. – Squeamish Ossifrage Nov 29 '19 at 16:17
  • 1
    (Aside from $m = 0$, the homomorphism $E_{y_B}(m_1, k_1) \cdot E_{y_B}(m_2, k_2) = E_{y_B}(m_1 m_2, k_1 + k_2)$ also probably violates IND-CPA.) – Squeamish Ossifrage Nov 29 '19 at 16:18
  • @Squeamish Ossifrage: Motivation started with the first comment to this answer. Would you care to develop your above remark into an answer? I see this property for one knowing random $k$ in the third encryption bullet, but I'm not immediately seeing how that allows a distinguisher by an adversary who does not, in variant 1, much less 2/3. – fgrieu Nov 29 '19 at 16:52
  • On reflection, maybe the homomorphism doesn't have any consequences for IND-CPA, since there's no way for the adversary to know $k_1$, $k_2$, or $k_1 + k_2$ as long as any pair of them is chosen by the challenger. Certainly the homomorphism doesn't apply at all in variants (2)/(3)/(4). It does carry for variant (1), though, because $(m_1 m_2 | p) = (m_1 | p) (m_2 | p)$. – Squeamish Ossifrage Nov 29 '19 at 16:58

0 Answers0