On CCA1-Security of Elgamal And Damgård’s Elgamal

We establish the complete complexity landscape surrounding CCA1-security of Elgamal and Damgård’s Elgamal (DEG). Denote by X [i] the assumption that the adversary, given a non-adaptive oracle access to the Y oracle with i free variables cannot break the assumption X . We show that the CCA1-security of Elgamal is equivalent to the DDH assumption. We then give a simple alternative to Gjøsteen’s proof that DEG cryptosystem is CCA1-secure under the DDH assumption. We also provide several separations. We show that DDH cannot be reduced to DDH in the generic group model. We give an irreduction showing that DDH cannot be reduced to DDEG (unless DDH is easy), DDEG cannot be reduced to DDH (unless DDEG is easy) and DDH cannot be reduced to the DDH(unless DDH is easy). All those irreductions are optimal in the sense that they show that if assumption X can be reduced to Y in polynomial time then X has to be solvable in polynomial time itself and thus both assumptions are broken.