Haenni, RolfKořánová, Ilona StarýVolkamer, MelanieDuenas-Cid, DavidRønne, Peter B.Ryan, Peter Y ABudurushi, JurlindKulyk, OksanaRodriguez Pérez, AdriàSpycher-Krivonosova, IuliiaKirsten, MichaelDebant, AlexandreGoodman, Nicole2024-12-132024-12-132023978-3-88579-741-81617-5468https://dl.gi.de/handle/20.500.12116/45439The subgroup of quadratic residues modulo a large safe prime is the most common choice in practice for the ElGamal cryptosystem. Computations in this group are simple and sufficiently efficient for at least 128 bits of security, and the DDH problem seems to be hard. In its practical application, however, this particular group has also several disadvantages, for example the relatively high cost for testing group membership or the uneven message space. In this paper, we discuss an alternative group for ElGamal, called multiplicative group of absolute values modulo a safe prime, which is isomorphic to the subgroup of quadratic residues, but with a slightly different group operation and much better properties for practical applications such as e-voting.enElGamal Encryption SchemeDDH AssumptionGroup TheoryFactoring GroupE-Voting ProtocolsPractical Implementations10.18420/e-vote-id2023_02