Talk:ElGamal encryption

message: The article looks broken, can anybody clean it up? --MrNightLifeLover (talk) 16:30, 21 November 2008 (UTC)

message: The title of this article is misleading and should be changed. This is an algorithm, a primitive used to build crypto systems. It is not itself a crypto system. Perhaps a pointer from this title to this article under the better title of 'ElGamal encryption algorithm'. See the cross reference (currently a dangling link) at article cryptography. user ww
:I agree. ElGamal is not a complete cryptosystem. Taw 19:58, 6 Apr 2004 (UTC)
replies: text:  Any suggestions for a better name? — Matt 02:36, 3 Aug 2004 (UTC)
replies: text:  It depends on how you define "cryptosystem."  To theorists, a cryptosystem is rigorously defined to be a key generator, encryption algorithm, and decryption algorithm.  ElGamal fits the bill...  On the other hand, I dislike the phrase "discrete log" in the title.  Security of ElGamal surely relies on the discrete log assumption, but in fact it needs something stronger (the Decisional Diffie-Hellman assumption, to be precise).  --Chris Peikert 22:10, 18 Nov 2004 (UTC)
replies: text: Chris, while you're right about cryptosystem in a strict sense, the term is used far more by applied crypto people than theory people, so IMHO wikipedia should use that definition. Arvindn 22:45, 19 Nov 2004 (UTC)
replies: text:  How about ElGamal cryptosystem then (also applying the principle that shorter names are better)? — Matt 23:31, 19 Nov 2004 (UTC)
replies: text:  I am OK with either ElGamal cryptosystem or ElGamal encryption or ElGamal encryption algorithm.  I think Arvindn's right that cryptosystem, at least on wikipedia, should be reserved to mean a "full package".  --Chris Peikert 06:33, 22 Nov 2004 (UTC)
replies: text:  OK, I've plumped for ElGamal encryption and added redirects for the others. — Matt 07:02, 22 Nov 2004 (UTC)
thread_title: Should be named??

message: It would seem to me that the algo that is described is the DH encryption, not the ElGamal signature scheme on which DSA is based. user mmy
ElGamal Encryption is based on Diffie-Hellman. ElGamal signatures are a completely different algorithm, and they're indeed similar to DSA and Schnorr signatures.  — Preceding unsigned comment added by 2A02:908:1A0:FCA0:1973:6D78:5F52:4AB9 (talk) 13:21, 23 March 2016 (UTC)
thread_title: Which algorithm is described here, anyway????

message: hello there,
the very simple explanation for decrytpting the message m:=(c1,c2) with c2/(c1^x) is apparently not correct.
here is a little example:
Bob:
p:= 11; phi(11) = 10; 10=2*5;
g:=2 (2^5 mod 11 !=1 and 2^2 mod p !=1 and therefore order(2,11)=10)
x:= 5 (0<=x— Preceding unsigned comment added by 157.193.2.198 (talk) 23:15, 15 June 2011 (UTC)
thread_title:  error in el-gamal decryption scheme 

message: Hi all, I rewrote this article with accuracy and security in mind, and I think it is alright now (two of the edits I accidentally submitted as anonymous, rather than via my account).
I included discussions of malleability (as suggested above) and efficiency (from the German translation).
However, I haven't done my homework vis-a-vis links to other wiki pages.  It would be great if someone could go through the text and take advantage of good linking opportunities.
--Chris Peikert 06:29, 22 Nov 2004 (UTC)
replies: text: Thanks, it's great work. I've gone through and added a few wikilinks. — Matt 07:02, 22 Nov 2004 (UTC)
thread_title:  Fixed this article 

message: It didn't make sense to have ElGamal signatures and ElGamal encryption on the same page. There are not many similarities between the two schemes other than both are by Taher ElGamal and are based on discrete logarithm. But there are many differences between the schemes, especially when one looks at the the parameter choices. For example choosing g=2 is ok for the encryption scheme but an insecure choise for the signature scheme. A group for which the Decision Diffie Hellman problem is solvable is a problem for the encryption scheme but not a problem for the signature scheme.
: Yep, sounds like the right thing to do. — Matt Crypto 21:36, 22 July 2005 (UTC)
thread_title:  ElGamal signatures vs. ElGamal encryption 

message: The name is spelled Elgamal, not ElGamal. Stern 19:00, 31 July 2005 (UTC)
replies: text: See Talk:Taher Elgamal for further discussion. I agree with Matt on this one. It's referred to virtually everywhere as "ElGamal". alerante ✆ 00:14, 19 October 2005 (UTC)
replies: text: Wikipedia goes with most common usage (see Wikipedia:Use common names). All major textbooks I've seen spells this ElGamal, so that is what this article should be named. I agree with User:Matt Crypto and User:Alerante. —Lowellian (reply) 03:20, 20 October 2005 (UTC)
thread_title: Spelling

message: the mods are left off the equations.   how is anyone going to know how to use this? --The preceding unsigned comment was added by 155.91.28.232 (talk) 23:42, 14 March 2007 (UTC)
replies: text: No. There are not mod operations missing. The article is written in a general form using a group G written multiplicatively. If G is the multiplicative subgroup F_p^* then all operations are done modulo p. However, G can be some other group, e.g. the group of points on an elliptic curve. 85.2.121.89 12:20, 24 March 2007 (UTC)
thread_title:  big problems 

message: I have tagged this statement as "citation needed". The currently referenced "Handbook of Applied Cryptography" specifically states that ElGamal with G=F_p^* is believed to be secure. If this information is out of date, a reference should be supplied to show that.
Also note that some current implementations do use F_p^*, so this is quite important to get right! Mbays 18:49, 22 March 2007 (UTC)
replies: text: Good point. The statement is at least ambigous, because the term "insecure" itself is unclear without stating an adversarial model. First, the DDH assumption in F_p^* does indeed not hold, because for a generator g it is possible to distinguish tuples g^a,g^b,g^{ab} from g^a,g^b,g^c with a nonnegligible probability, by computing Legendre symbols of the values. Similarly, from an encryption (g^r, y^r m) we can derive the Legendre symbol of m as follows. Computing the Legendre symbol (g^r|p) tells us if r is odd or even. The Legendre symbol (y|p) = (g^x|p) tells us whether x is odd or even. Thus we know the parity of x r and thus also the value of (y^r|p). Hence, we know the Legendre symbol (m|p)=(y^r m|p)/(y^r|p). Hence ElGamal encryption over F_p^* is not semantically secure. Note that if RSA has a same problem when used without padding. Given c=m^e \bmod{n} one can easily derive the Jacobi symbol (m|n)=(c|n). Using prime order subgroups instead of F_p^* gives sematic security, but not security against adaptive chosen ciphertext attatcks. Therefore, ElGamal encryption (as well as RSA encryption) must use a padding scheme in order to be secure against adaptive chosen ciphertext attacks. 85.2.11.148 21:18, 22 March 2007 (UTC)
replies: text:  OK yes, I see the argument that the group has to be of prime order. I still think it needs a citation, though. As an aside: any idea how serious a problem this actually is? Presumably it depends on how small is the largest prime you can expect to be a factor of p-1. As a further aside: would you suggest that this be reported as a bug to developers of implementations which use F_p^*? Mbays 16:53, 23 March 2007 (UTC)
replies: text:  My previous comment wasn't very clear. While ElGamal over appropriate prime order subgroups is semantically secure and ElGamal over F_p^* is not we should not conclude that any ElGamal implementation using the group F_p^* is immediately insecure and any system using a prime order subgroup is secure. It all depends on what padding scheme is used. For example, DHAES does not require groups for which the Decisional Diffie-Hellman assumption holds and still achieves security against chosen plaintext attacks. (Unfortunately, DHAES is not exactly ElGamal, just similar. But it should make the point clear. Anyway, I'll continue to look for a better example.) Also, I haven't found a reference for the sementically secure/not semantically secure comment above. It seems to be general knowledge, however. Who is using ElGamal encryption in their implementation? 85.2.99.179 18:57, 23 March 2007 (UTC)
replies: text:  Would Appendix A of that paper do as a reference for the statement? Mbays 20:16, 23 March 2007 (UTC)
replies: text:  Yes, indeed. I didn't notice the appendix.  85.2.57.232 00:54, 24 March 2007 (UTC)

text:  OpenPGP is an implementation that uses F_p^* for ElGamal to exchange key packages. These key packages are padded using PKCS #1 encryption padding. Since PKCS #1 encryption padding adds randomness this does take care of fact that ElGamal over F_p^* is not semantically secure. Using a prime order subgroup would still be slightly nicer, because then one would have a proof that the scheme is sematically secure. But at least in the case of OpenPGP it is not wrong (or at least not immediatly obvious) to use F_p^*. (However, I'd prefer OAEP padding instead of PKCS #1 padding.) 85.2.121.89 12:52, 24 March 2007 (UTC)

text: A good citation for DDH holding in certain groups would be Dan Boneh's nice survey article. The second page has a quick list of groups believed to have the DDH property. The reduction from DDH to Elgamal's semantic security (CPA) is very common and very simple. An example proof can be seen here for instance (from a site I have quite an investment in, actually!). Blokhead 05:27, 24 March 2007 (UTC)
replies: text:  The link to the proof looks very useful. Boneh's paper is already referenced on the DDH page. 85.2.121.89 12:52, 24 March 2007 (UTC)

text: I was thinking of updating the section on the security, but there is still a reference missing. In particular, I'm looking for a reference that shows that assuming the computational Diffie-Hellman assumption for a group (or family of groups) implies that inverting ElGamal encryption is hard. This statement seems easy to prove. I.e., assume we are given an oracle that on input g, g^a, y=g^x, m g^{ax} returns m Then we can use this oracle to find g^{ab} given g, g^a, g^b as follows: Choose a random group element r and call the oracle with g, g^a, g^b ,r. Assume it returns m' as result. Then we can compute g^{ab} from m' g^{ab}=r. The "Handbook of Applied Cryptography" probably refers to something similar when it states that ElGamal over  F_p^* is believed to be secure. Unfortunately, the book doesn't make a clear statement and doesn't give a reference. 85.2.110.35 07:20, 29 March 2007 (UTC)
thread_title:  insecurity of G := F_p^* 

message: I am reading "Handbook of Applied Cryptography" (there is a free PDF online), which uses G = \Z_{p}^{*} and states the the private key should be a random integer [1, p - 2]. The article claims it should be (after plugging in for q), [0, p - 2]. Furthermore, the book lists the same range, [1, p - 2] for ElGamal signatures, but the article on that on Wikipedia lists [2, p - 2]. Basically:
                  	Book      	Paper     	Wikipedia
ElGamal encryption	[1, p - 2]	N/A       	[0, p - 2]
ElGamal signing   	[1, p - 2]	[1, p - 1]	[2, p - 2]
I am also reading a research paper, "Breaking Smart Card Implementations of ElGamal Signature and Its Variants", listed as paper.
Also, the "generate a random number in *range*" bits differ. For example, in encryption, we are told to "choose a random y from {0, ... q - 1}, or, in the case of G = \Z_{p}^{*}, [0, p - 2]. Book differs.
                        	Book      	Paper     	Wikipedia
Random int in encryption	[1, p - 2]	N/A       	[0, p - 2]
Random int in signing   	[1, p - 2]	[1, p - 1]	[0, p - 2]
To me it seems that encryption stuff is fragile as hell, and one mistake seems to bring the whole thing down, but here I've got three resources telling me different things. The differences don't stop at ranges - some want the random numbers to not divide p - 1, others want them to have a GCD of 1.
Chapter 8, page 294 of "Handbook of Applied Cryptography", and Chapter 11, page 454, same book for encryption and signature, respectfully.
Deathanatos (talk) 07:37, 20 September 2010 (UTC)
thread_title:  Key generation - error in article? 

message: There is currently an open question whether q must be prime. In the original paper by ElGamal the group G=Z/(p) (that is the group of residues modulo a prime p) is used and ElGamal proposes to use a primitive element as the generator. Such a generator has order q=p-1, which is of course divisible by 2. So far I'm not aware of a reason why ElGamal's choice does not work other than simplifying the analysis of a protocol. I.e., if one uses a subgroup of prime order then the DDH assumption may be applicable, which can simplify things. Depending on the protocol that uses ElGamal encryption DDH may be necessary, unecessary or may not be sufficient. Hence, results that can only be obtained by using a prime order group should be added (together with a reference) to the security section. However, we should not restrict the group order in the main section, unless there is a result showing that a group order that is not prime leads to attacks. 178.195.225.28 (talk) 16:49, 29 May 2012 (UTC)
replies: text: To me, it seems that that whole section needs revising and clarifying. For example, shouldn't the h=g^x be done modulo p (as in the paper?). I can't see where the description of the group is. Handheldpenguin (talk) 17:37, 29 May 2012 (UTC)
replies: text:  Any group G for which the DH problem is infeasible may be used. This can be G=Z/(p), but it is also possible to use a group of points on an elliptic curve. The security section discusses some constraints on G. 178.195.225.28 (talk) 05:35, 30 May 2012 (UTC)
thread_title:  Is q a prime number? 

message: Hello fellow Wikipedians,
I have just modified one external link on ElGamal encryption. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20090421130001/http://crypto.cs.uiuc.edu/wiki/index.php/Elgamal_encryption_scheme to http://crypto.cs.uiuc.edu/wiki/index.php/Elgamal_encryption_scheme
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 15:36, 18 September 2017 (UTC)
thread_title:  External links modified 

message: This article could definitely be amended with other variants of ElGamal, such as over arbitrary finite abelian groups (as they are products of cyclic p-groups), over finite fields, and when considering elliptic curve groups over a finite fields (these are also abelian). Only mentioning cyclic groups seems reductive, and the article could definitely use some expansion given its importance. Callie Liddle (talk) 06:46, 7 October 2023 (UTC)
thread_title:  More than just cyclic groups