Encoding-Free ElGamal Encryption Without Random Oracles

Abstract

Abstract. ElGamal encryption is the most extensively used alternative to RSA. Easily adaptable to many kinds of cryptographic groups, ElGamal encryption enjoys homomorphic properties while remaining semantically secure providing that the DDH assumption holds on the chosen group. Its practical use, unfortunately, is intricate: plaintexts have to be encoded into group elements before encryption, thereby requiring awkward and ad hoc conversions which strongly limit the number of plaintext bits or may partially destroy homomorphicity. Getting rid of the group encoding (e.g., with a hash function) is known to ruin the standard model security of the system. This paper introduces a new alternative to group encodings and hash functions which remains fully compatible with standard model security properties. Partially homomorphic in customizable ways, our encryptions are comparable to plain ElGamal in efficiency, and boost the encryption ratio from about 13 for classical parameters to the optimal value of 2.

Encoding-Free ElGamal-Type Encryption Schemes on Elliptic Curves

“…The scheme of Chevallier-Mames et al [9] is based on the class function over cyclic subgroups of F * p . Specifically, for primes p and q such that q | p − 1, given a cyclic subgroup g ⊆ F * p of order q, the class of w = g a mod p (w.r.t.ĝ) is denoted by [[w]] and is defined as the unique integer in Z/pZ such that…”

“…In an earlier work, ChevallierMames et al [9] astutely observe that certain mathematical properties of integers modulo p 2 , where p is a prime number, allow getting rid of the message encoding from the classical ElGamal cryptosystem. Unfortunately, the solution of [9] is not known to be readily instantiable over elliptic curve subgroups. As a consequence, the Chevallier-Mames et al [9] system loses the benefit of shorter keys enabled by elliptic curve cryptography.…”

“…Unfortunately, the solution of [9] is not known to be readily instantiable over elliptic curve subgroups. As a consequence, the Chevallier-Mames et al [9] system loses the benefit of shorter keys enabled by elliptic curve cryptography. In this work, we solve a problem left open by Chevallier-Mames et al [9] and provide an adaptation of their scheme [9] to the elliptic curve setting.…”

“…As a consequence, the Chevallier-Mames et al [9] system loses the benefit of shorter keys enabled by elliptic curve cryptography. In this work, we solve a problem left open by Chevallier-Mames et al [9] and provide an adaptation of their scheme [9] to the elliptic curve setting. The resulting encryption schemes features the same ciphertext expansion ratio as [9] and retains the partial homomorphism properties (additive or multiplicative).…”

“…In this work, we solve a problem left open by Chevallier-Mames et al [9] and provide an adaptation of their scheme [9] to the elliptic curve setting. The resulting encryption schemes features the same ciphertext expansion ratio as [9] and retains the partial homomorphism properties (additive or multiplicative). We prove that they are semantically secure in the standard model under a natural hardness assumption.…”