Editing ElGamal encryption (section)

=== Encryption ===
A second party, Bob, encrypts a message <math>M</math> to Alice under her public key <math>(G,q,g,h)</math> as follows:

* Map the message <math>M</math> to an element <math>m</math> of <math>G</math> using a reversible mapping function.
* Choose an integer <math>y</math> randomly from <math>\{1, \ldots, q-1\}</math>.
* Compute <math>s := h^y</math>. This is called the ''shared secret''.
* Compute <math>c_1 := g^y</math>.
* Compute <math>c_2 := m \cdot s</math>.
* Bob sends the ciphertext <math>(c_1,c_2)</math> to Alice.

Note that if one knows both the ciphertext <math>(c_1,c_2)</math> and the plaintext <math>m</math>, one can easily find the shared secret <math>s</math>, since <math>c_2 \cdot m^{-1} = s</math>. Therefore, a new <math>y</math> and hence a new <math>s</math> is generated for every message to improve security. For this reason, <math>y</math> is also called an [[ephemeral key]].