AsymmetricLegacy - avoid
ElGamal encryption
Public-key encryption (also a signature scheme)
How it works
ElGamal is public-key encryption built on the same discrete logarithm problem as Diffie-Hellman. Each encryption uses a fresh random value, so encrypting the same message twice gives different ciphertexts. Older OpenPGP implementations used it for encryption keys, and DSA descends from the ElGamal signature scheme.
Status: Not broken, but rarely used today and not a NIST-approved scheme; modern designs use ECDH-based hybrids.
Strengths
- Probabilistic: identical plaintexts do not produce identical ciphertexts.
- Multiplicatively homomorphic, which is useful in some voting and privacy schemes.
Weaknesses and known attacks
- Ciphertext is twice the size of the plaintext.
- Malleable: an attacker can transform a ciphertext into a related one without the key.
- Reusing the per-message random value breaks security.
Use it for
- Recognising it in OpenPGP keys and exam questions
Don't use it for
- New designs
Exam tip
ElGamal is asymmetric and based on discrete logarithms, like Diffie-Hellman and DSA. RSA is the odd one out (factoring).