> For the complete documentation index, see [llms.txt](https://valargroup.gitbook.io/shielded-vote-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://valargroup.gitbook.io/shielded-vote-docs/appendices/el-gamal.md).

# El Gamal on Pallas

Shielded Vote uses additively homomorphic El Gamal encryption over the Pallas curve to encrypt vote share amounts.

## Setup

Let `G` be the generator of the prime-order subgroup of the Pallas curve, and let `R = ea_pk = ea_sk * G` be the election authority's public key.

**IMPORTANT:** `G` must be the generator of the prime-order subgroup. Using an arbitrary point would break the homomorphic property and security guarantees.

## Encryption

To encrypt a value `v` with randomness `r`:

```
Enc(v, r) = (r * G,  v * G + r * R)
```

The ciphertext is a pair of Pallas points `(C1, C2)`.

## Additive homomorphism

Given two ciphertexts `Enc(a, r1)` and `Enc(b, r2)`, component-wise point addition yields a valid encryption of the sum:

```
Enc(a, r1) + Enc(b, r2)
  = (r1*G + r2*G,  a*G + r1*R + b*G + r2*R)
  = ((r1+r2)*G,  (a+b)*G + (r1+r2)*R)
  = Enc(a+b, r1+r2)
```

This allows anyone to publicly sum encrypted vote shares without decryption.

## Decryption

Given a ciphertext `(C1, C2)` and the secret key `ea_sk`:

```
C2 - ea_sk * C1
  = v*G + r*R - ea_sk * r*G
  = v*G + r*ea_sk*G - ea_sk*r*G
  = v*G
```

This yields `v * G`, not `v` directly. To recover `v`, we perform a **bounded discrete log lookup** — feasible because the total vote weight is bounded by ZEC supply (\~21M ZEC, so `v` is at most \~2.1 \* 10^15 zatoshi). In practice, for aggregate tallies, baby-step giant-step or a precomputed lookup table is sufficient.

> **Why ballot scaling matters here:** Vote values are expressed in *ballots* (zatoshi floor-divided by 12,500,000) rather than raw zatoshi. This reduces the bit-width of the values being encrypted, which directly speeds up El-Gamal encryption (smaller scalars in the fixed/variable-base multiplications), makes the bounded discrete-log search at decryption time faster (smaller search space), and tightens the in-circuit range checks needed elsewhere in the proof system.