Re: Weak keys for ElGamal

Hi,

Note that hardness of DLP is not sufficient to prove the security of
ElGamal: You need DDH for that.
Yes, for the semantic security of ElGamal I need the DDH assumption.

I am thinking of the following scenario: Let's consider a signature
scheme. A party now uses her secret key to sign a message m. Later on
then she claims, that she didn't sign the message m and she can
convince the other parties from that fact because she chooses "by
chance" (or intentionally exactly to be able to refuse the signature
later on) a "weak key".

Anton

.