Subject: [Cfrg] ElGamal Encryption, ECDH, and Uniformly Distributed keys

From: Robert Moskowitz <[email-masked]>
Date: Thu, 24 Jun 2010 08:18:45 -0400

draft-irtf-cfrg-kdf-uses-00.txt, amongst other sources, points out that 
DH derived keys are not uniformly distributed and need 'an extraction 
phase'.  Yet ElGamal Encryption is doing an encryption step directly 
with its key.  Of course there are various issues with ElGamal Encryption...

Does ElGamal Encryption also 'suffer' from its key not being uniformly 
distrbuted?

My question is looking for a source that covers the nature of the attack 
becuase the DH derived key is not uniformly distributed.   I seem to 
recall one message pointing to a paper, but can't find it.

How does the attack vary by the use of the key.  For example the key is 
used to encrypt a uniformly distributed random number that will actually 
be used as a key.  The key is used to encrypt a few hundred such random 
keys.  Etc.

Every where I have looked, including all of the text books I have only 
say, "DH is not uniformly distributed, its a problem."