Linear Generalized ElGamal Encryption Scheme Pascal Lafourcade1 a,Leo´ Robert1 b and Demba Sow2 c 1Universite´ Clermont Auvergne, LIMOS CNRS (UMR 6158), Campus des Cezeaux,´ Aubiere,` France 2LACGAA, Universite´ Cheikh Anta Diop de Dakar, Senegal Keywords: Cryptography, Partial Homomorphic Encryption, Linear Assumption, ElGamal Encryption Scheme. Abstract: ElGamal public key encryption scheme has been designed in the 80’s. It is one of the first partial homomorphic encryption and one of the first IND-CPA probabilistic public key encryption scheme. A linear version has been recently proposed by Boneh et al. In this paper, we present a linear encryption based on a generalized version of ElGamal encryption scheme. We prove that our scheme is IND-CPA secure under linear assumption. We design a generalized ElGamal scheme from the generalized linear. We also run an evaluation of performances of our scheme. We show that the decryption algorithm is slightly faster than the existing versions. 1 INTRODUCTION sional Linear Assumption (DLA) and a variation of ElGamal encryption scheme. Our aim is to improve In 2009 in his thesis (Gentry, 2009), G. Grentry pro- this linear version of ElGamal encryption scheme us- posed the first fully homomorphic encryption scheme. ing the same approach proposed in (Sow and Sow, It was a revolution and it solves an open problem 2011). already stated by Rivest Shamir and Adelman when they invented RSA in (Rivest et al., 1978). Many ad- Contributions. We propose the following results: vances have been done and nowadays we have some • efficient implementations like for instance SEAL de- Most of today’s public key cryptosystems are re- veloped by Microsoft (SEAL, 2019). However for sistant to various types of attacks and are effec- some applications like the inversion of a large ma- tive. Their main role is the protection of commu- trix or multiplications of large matrices fully homo- nications so they guarantee the security of the data morphic encryption schemes can be very slow or pro- exchanged or stored. Thus, it will always be inter- duce large ciphertext or even be inexact. It is why esting to find a new encryption scheme or to im- all partial homomorphic encryptions like RSA (Rivest prove a known one. It is in this context that we et al., 1978), GM (Goldwasser and Micali, 1982), propose a linear Generalized ElGamal encryption ElGamal (Elgamal, 1985), Benaloh (Benaloh, 1999; scheme. The modifications are about the key gen- Fousse et al., 2011), Okamoto-Uchiyama (Okamoto eration which lead to a different encryption and and Uchiyama, 1998), Naccache-Stern (Naccache decryption algorithms. Like linear ElGamal en- and Stern, 1998), Paillier (Paillier, 1999) or Gal- cryption, the linear Generalized ElGamal encryp- braith (Galbraith, 2002), are still widely used. They tion scheme is IND-CPA secure under (DLA). can be used to solve such problems in reasonable • We also propose the ElGamal and the Generalized among of time like in (Ciucanu et al., 2019). ElGamal schemes from the generalized linear. Many cryptosystems rely on the Diffie-Hellman • We implement the algorithms and compare their decision problem (DDH) (Boneh, 1998; Joux and performances with the original algorithms. Our Guyen, 2006) assumption, notably the ElGamal en- performance evaluations show that the decryption cryption scheme and the Cramer-Shoup encryption algorithm is faster. We also demonstrate that our scheme (Cramer and Shoup, 1998). In (D. Boneh and key generation algorithm is slower, but this is not Shacham, 2004b), Boneh et al. introduced the Deci- a problem since this operation is usually done a https://orcid.org/0000-0002-4459-511X only once. b https://orcid.org/0000-0002-9638-3143 c https://orcid.org/0000-0002-1917-2051 372 Lafourcade, P., Robert, L. and Sow, D. Linear Generalized ElGamal Encryption Scheme. DOI: 10.5220/0009828703720379 In Proceedings of the 17th International Joint Conference on e-Business and Telecommunications (ICETE 2020) - SECRYPT, pages 372-379 ISBN: 978-989-758-446-6 Copyright c 2020 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved Linear Generalized ElGamal Encryption Scheme Related Works. In 1985, Taher ElGamal (Elgamal, 2 ElGamal AND GENERALIZED 1985) proposed an encryption and signature scheme ElGamal ENCRYPTION called ElGamal scheme. In (Hanoymak, 2013), Turgut Hanoymak proves SCHEMES the security of ElGamal encryption scheme which is based on the hardness to solve the Computa- We recall the ElGamal encryption scheme (Elga- tional Diffie-Hellman (CDH) and Decisional Diffie- mal, 1985) and the Generalized ElGamal encryption Hellman (DDH) problems. scheme (Sow and Sow, 2011). In (D. Boneh and Shacham, 2004b), Boneh et al. proposed a linear encryption scheme based on the El- 2.1 The ElGamal Encryption Scheme Gamal encryption scheme. The linear ElGamal en- cryption scheme is IND-CPA secure under the (DLA). Given a computational group scheme G, the ElGamal In (Sow and Sow, 2011), a modified variant of public-key encryption is defined as follow (Elgamal, the ElGamal scheme is presented, and it is called 1985): Generalized ElGamal. As ElGamal’s scheme, the Generalized ElGamal scheme is based on Decisional Key Generation Algorithm. For the creation of a Diffie-Hellman Problem (DDH). In the Generalized public/secret key, Bob should do the following: ElGamal scheme, the decryption key size is smaller 1. Select a finite cyclic group G of order d than those of ElGamal scheme. Hence the General- with generator g. ized ElGamal scheme is more efficient than ElGamal 2. Select a random integer a such that 2 < a < d. a scheme; since the decryption process is a bit faster. 3. Compute h = g in G. The encryption mechanism has the same efficiency 4. The public key is pk = (G;d;g;h) and the than ElGamal encryption mechanism. But, the key secret key is sk = a. generation algorithm is slower than the key genera- tion algorithm of ElGamal scheme. However, this is Encryption Algorithm. To encrypt a message m not a problem since the key generation is done only for Bob, Alice should do the following: once. 1. Take pk = (G;d;g;h), the Bob’s public key; 2. Select a random integer r such that Outline of Paper. In Section 2, we present the orig- 1 < r < d = #G; r r inal ElGamal encryption scheme and the Generalized 3. Compute c1 = g and c2 = m · h in G; ElGamal encryption scheme. In Section 3, we present 4. The ciphertext is c = (c1;c2). the Linear assumption, the linear ElGamal encryp- tion scheme and the ElGamal encryption scheme from Decryption Algorithm. To decrypt a ciphertext c, the generalized linear. In Section 4, we propose the Bob should do the following: linear Generalized ElGamal encryption scheme and 1. Take sk = a the secret key. the Generalized ElGamal encryption scheme from the c2 2. Compute m = a , we note that m 2 G. generalized linear. In Section 5, we propose a com- (c1) 3. The plaintext is m. plexity analysis of our scheme. In Section 6.1, we present the curves showing the average time of the key generation, encryption and decryption algorithms Security Proof of ElGamal Encryption. We recall of the ElGamal encryption scheme and the General- some theorems, which show the security of ElGamal ized ElGamal encryption scheme. In Section 6.2, we encryption scheme under the CDH and DDH assump- k also present the curves showing the average time of tions. Let GP an algorithm which takes 1 and re- the key generation, encryption and decryption algo- turns the public key pk = (G;d;g;h) of the ElGamal rithms of the Linear ElGamal encryption scheme and encryption scheme. the Linear Generalized ElGamal encryption scheme. I One-wayness under the CDH Assumption. If Note that a full version with the security proofs is the CDH assumption holds with respect to GP , available on (Extended Version, ). then the ElGamal encryption scheme is one-way. Theorem 2.1. Let adversary A be a probabilis- tic polynomial-time algorithm against the ElGa- mal encryption scheme (Elgamal, 1985) in the OW-CPA sense. Then there is a probabilistic 373 SECRYPT 2020 - 17th International Conference on Security and Cryptography polynomial-time algorithm B against GP solving 3. Transform the message m as an element of G and the CDH problem such that: compute c2 = lm in G. CDH OW−CPA The ciphertext is (c1;c2). AdvGP ;B (k) = AdvP;A (k): Decryption Algorithm. To decrypt a ciphertext of I Indistinguishability under the DDH Assump- tion. If the DDH assumption holds with respect the form (c1;c2) that is encrypted with the public to , then the ElGamal encryption scheme is key ((g;d);d;G) and knowing the associate secret key GP r indistinguishable under chosen-plaintext attacks, (r;G), we just need to compute c1c2. i.e., it is IND-CPA secure. Theorem 2.2. Let adversary A be a probabilis- Provable Security of the Generalized ElGamal En- tic polynomial-time against the ElGamal encryp- cryption Scheme. tion scheme in the IND-CPA sense. Then there I One-wayness under the CDH Assumption. is a probabilistic polynomial-time algorithm B Theorem 2.4. Under the CDH Assumption, the against GP solving the DDH problem such that: Generalized ElGamal encryption scheme is One- 1 Way secure under Chosen Plaintext Attack (OW- AdvDDH (k) = · AdvIND−CPA(k): GP ;B 2 P;A CPA). That is, for a security parameter k, if there is an attacker A that inverse the Generalized El- I Semantic Security. In (J. Katz, 2008), Katz and Gamal encryption then we can build an algorithm al. prove the semantic security of the ElGamal B that solves CDH, it means that encryption scheme. AdvCDH (k) = AdvOW−CPA(k): Theorem 2.3. Under the DDH assumption, El- GP ;B P;A Gamal encryption scheme is semantically secure.