On the CCA1-Security of Elgamal and Damgård's Elgamal

It is known that there exists a reduction from the CCA1security of Damg̊ard’s Elgamal (DEG) cryptosystem to what we call the ddh assumption. We show that ddh is unnecessary for DEGCCA1, while DDH is insufficient for DEG-CCA1. We also show that CCA1-security of the Elgamal cryptosystem is equivalent to another assumption ddh, while we show that ddh is insufficient for Elgamal’s CCA1-security. Finally, we prove a generic-group model lower bound Ω( 3 √ q) for the hardest considered assumption ddh, where q is the largest prime factor of the group order.