Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could it be more secured using the "HTTPS" protocol for website data security and at the same time using another encryption algorithm (Elgamal) as well?

I know "HTTPS" could be used alone, but I found according to these links (Gone in 30 seconds - New Attack on RSA-based SSL/TLS Protocol) that it could be attacked, and data security is so critical in my system, so I need a high level for it.

share|improve this question
First focus on making HTTPS as secure as possible. This includes forward secure ciphersuites, enabling HSTS, supporting most recent versions of TLS, disabling HTTP compression, using an SSL implementation that mitigates BEAST, disabling SSL 2.0 and SSL 3.0... In practice most of these issues boil down to using the latest version of OpenSSL with proper configuration. – CodesInChaos Oct 11 '13 at 10:59

No, there are two reasons while coupling SSL with "ElGamal encryption" won't make your data "more secure".

The first reason is that among the two known attacks that you link to, one has been fixed for long (it is a variant of Bleichenbacher's attack from 1998, using a padding oracle; it is fixed by making the SSL server not reporting padding errors at the RSA stage), and the other is generic upon the use of compression on a data stream which contains secret data and attacker-chosen data at the same time (as long as encryption leaks information on the encrypted data length, compression will be an aggravating issue, regardless of the encryption algorithm, even if several are piled on each other). Putting some other algorithm in the mix would not offer any significant advantage for either.

The second reason is that your suggestion does not make sense. ElGamal is an asymmetric encryption algorithm (named after its inventor) which, by nature, encrypts only a single short element (no more than a few hundred bytes). If you were cascade SSL with some other encryption system, that other encryption system would be a symmetric encryption algorithm (e.g. the AES), any asymmetric algorithm like ElGamal being used only for an initial key exchange... just like SSL does with RSA or Diffie-Hellman.

Indeed, when you write this:

I know "HTTPS" has the same function as "Elgamal"

well, you are wrong. The two things are not comparable and don't have the same function.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.