Subject: Re: [Cfrg] one question about ElGamal encryption over a subgroup

From: Greg Rose <[email-masked]>
Date: Wed, 15 Oct 2003 08:08:09 +1000

At 10:14 AM 9/11/2003 -0400, Wang, Steve wrote:
>I have one question about the security of ElGamal encryption over a
>subgroup. The original ElGamal encryption uses a large prime p and a
>generator g. What will happen if the order of g is not p-1 but another
>prime q, which divides p-1? Is the encryption secure if q is 160-bit
>long?

Secure at the equivalent of an 80-bit symmetric key, yes. Well, so long as 
p is big enough (say 1024 bits). For security of similar order to AES-128, 
you probably want p ~4000 bits, and q of 256 bits.

Greg.

Greg Rose                                       INTERNET: [email-masked]
Qualcomm Australia          VOICE:  +61-2-9817 4188   FAX: +61-2-9817 5199
Level 3, 230 Victoria Road,                http://people.qualcomm.com/ggr/
Gladesville NSW 2111    232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg