import hashlib, time;

#Our ElGamal prime p for the assignment
p = 19557005198709002903944860293031210393112763219086296641657077101075696217230957575932867920574816565856404011416908876733063974554042055901449481509845537165833627083609136426386625960849573203936690977282752217830467255076903813033768202255463477317279507253420233052258146393806024179130344501759742626253484354878829682461413002143954786668386100202257237258007726886368228024987052808444032800050116408995869561195208576647050961019393809940446490709061546503439488751331252440431940049716566765873615456614911458658341732120931319694200689362617296630728389003180670326151653001322354906363854478585334821235883;

q = Integer((p-1)/2); q

#Here we check p=2q+1 where q is also prime... ATTENTION this a time-consuming operation!!!!
q in Primes()

#p is a 2048-bit long prime number
len(p.bits()), len(p.digits())

#Here we check that g=2 generates G_q in Z_p^*
power_mod(2,2,p), power_mod(2,q,p)

#Here we generate an ElGamal key pair
g = 2; sk = ZZ.random_element(q-1); h = power_mod(g,sk,p); sk,h

#The procedure next, namely xor_str, computes the eXclusive OR of two hexadecimal strings
def xor_str(a,b):
    result = int(a, 16) ^^ int(b, 16) # convert to integers and xor them
    return '{:x}'.format(result)     # convert back to hexadecimal

ptxt = "pookxxxxxxxxxxxx"; len(ptxt);

r = ZZ.random_element(q);

def enc_ex3(r,ptxt):
    c1 = power_mod(2,r,p);
    pad = hashlib.sha256(hex(power_mod(h,r,p))).digest().encode("hex");
    hexptxt = ptxt.encode("hex");
    c2 = xor_str(pad,hexptxt)
    return [c1,c2]


enc_ex3(r,ptxt)

c1 =3865956422439096490561858169338041096701333526494105551754695037099250072711538384135463733852225456900579184566315749321909007011216509707298475810545198562519794548131125428106873491615779742881161462822148632176412984981144936463502698762319328468352423740747900300862485858375796070251826151390710179824115777716607803992836131053488943672740820131095121900635436263379270389303101410104761642550562824471831144096742672224721170804251645941212717381891358941184349210760059816588343372596085913747206123868274949773510684402863690038411417418044329435624394412554742705928679970846473474256415463990040965950641;

c2= 'f6f3316f45688a95ae92295890057937fce22484ead73f31de504f68e54d649f';

# decryption function, the decryption function takes in c1 and c2 as inputs
def dec_ex3(c1,c2):
    pad = hashlib.sha256(hex(power_mod(c1,sk,p))).digest().encode("hex");
    message = xor_str(pad,c2)
    return message.decode("hex")

dec_ex3(c1,c2);