3

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts.

The problem is that I need to return the original plaintext sum values. How could I get them using decryption? Is there an algorithm I can follow, given that I have both the private and public keys?

I have tried to decrypt it, but it returns the value $((g^{x+y}) \bmod P)$ where $p$ is prime, $g$ is a generator, and $x$ and $y$ are the plaintext which I need to know.

$x+y$ is usually a very large number.

Gilles 'SO- stop being evil'
  • 19,134
  • 4
  • 50
  • 92
user2511133
  • 31
  • 1
  • 2

3 Answers3

6

Normal El Gamal is multiplicatively homomorphic: $E(x) E(y) = E(xy)$.

If you want to make it additively homomorphic, you fix some generator $g$; then you transform the integer $x$ to the group element $g^x$ before encrypting with El Gamal. With this transformation, $E(g^x) E(g^y) = E(g^x g^y) = E(g^{x+y})$, so now you have an additive homomorphic property.

To decrypt, you need to be able to take the discrete logarithm. This can be done efficiently if the value $x+y$ is known to be "not too large".

For a bit more of an overview of this approach to making El Gamal additively homomorphic, see the following question: Can Elgamal be made additively homomorphic and how could it be used for E-voting?. Then, check out Why is the discrete log problem easy when the exponent comes from a binomial distribution? for details of specifically how to do the decryption, and how small the messages need to be to ensure you can decrypt in a reasonable amount of time. In the future I encourage you to use the search function to check whether the question has been asked before.

If $x+y$ is usually so large that the above methods don't work, then you'll need a different cryptosystem; simple El Gamal isn't gonna work for you. The Paillier cryptosystem might be a good choice.

Community
  • 1
D.W.
  • 36,365
  • 13
  • 102
  • 187
  • Thank you so much for your answer but unfortunately (X+Y) usually in a very large number so i was just asking if there is any modification that i can do on the decryption so i can get the value without using the discrete logarithm – user2511133 Jul 03 '13 at 09:27
3

unfortunately $x+y$ is usually a very large number so i was just asking if there is any modification that i can do on the decryption so i can get the value without using the discrete logarithm

In general no, but if you know some additional information about $x+y$ it is possible (depending on how good the information is). For example, say $x$ and $y$ come from some process and I know the mean value for $x$ and the mean value for $y$, then I also know the mean value for $x+y$ and can use that to decrypt (compute $g^t$ in the group for values $t$ around the mean of the sum and compare with $g^{x+y}$).

Another example would be in electronic voting. If there are a large number of voters, the value you are trying to decrypt could be very large, but you probably know (approximately) how many people voted and you know polling data which would tell you approximately the percent of people who were going to vote for candidate $C$, so to decrypt candidate $C$'s vote tally, multiply the percent by the approximate number of voters and you have a decent guess as to the number of people who voted for $C$. Use that information to start computing around the guess as before.

mikeazo
  • 38,563
  • 8
  • 112
  • 180
-2

You can use El Gamal over elliptic curves.

Your current understanding of El Gamal is carried over to EC El Gamal, with the following alterations to the implementation of El Gamal encryption & decryption:

1) You calculate over elliptic curves (mildly complicated & out of scope).

2) Group operation is now addition instead of multiplication: powers become scalar multiplications (over EC), multiplications become additions (over EC).

With this modified El Gamal, you can use shorter key lengths as typical of elliptic curves. The resulting scheme is also "plainly" additively homomorphic in the same way that plain El Gamal is multiplicatively homomorphic -- no need to solve DLP.

nadavwr
  • 117
  • 3
  • Thats true, but a homomorphism with respect to addition of points on the curve is usually not very useful. Typically one wants to have addition of integers (modulo the (sub)group order). – DrLecter May 18 '14 at 15:32
  • @DrLecter Granted it isn't useful for problems that require counting or ordering (e.g. voting). Additive homomorphism over elliptic curves does have valid use cases, though, such as homomorphic signatures. – nadavwr May 19 '14 at 16:14
  • I aggree, but the question is about additively homomorphic ElGamal encryption ;) – DrLecter May 19 '14 at 16:19
  • @DrLecter I provided homomorphic signatures as an example for privacy preserving calculations that can be performed on ciphertexts. I suppose there are less contrived examples, but they would all be building blocks of larger cryptographic schemes -- not many other uses for points on curve. – nadavwr May 19 '14 at 18:56
  • This solution requires computing a discrete logarithm over an elliptic curve. – user94293 May 21 '16 at 01:28
  • It does not—exponential El Gamal over Zq (which is additively homomorphic) does, but straightup El Gamal over elliptic curves (which is also additively homomorphic) does not. – nadavwr May 21 '16 at 06:32