Walk through a concrete EC ElGamal (VM98) encryption using the curve $y^2 \equiv x^3 + x + 6 \mod 11$ with base point $P(3, 6)$.

Bob's secret $d$, public key $Q = d \cdot P$. Alice picks ephemeral $i=5$, computes ephemeral key $K_E = 5P = (2,4)$, masking key $K_M = 5Q = (8,3)$. Encrypts plaintext $T=7$ as $Y = T \oplus x_{K_M} = 7 \oplus 8 = F$. Sends $(Y, K_E)$.

* Alice masks $T$ with the x-coordinate of $K_M=i\cdot Q$; Bob rebuilds the same $K_M = d\cdot K_E$ and XORs it back — Eve, lacking the ECDLP solution, cannot. *

Setup: $E: y^2 = x^3 + x + 6 \mod 11$, $P(3,6)$, group order $|E| = 13$ (prime, so $h=1$)

Key Generation (Bob):

• Chooses secret $d$ (e.g., $d = 10$)
• Computes public key: $Q = d \cdot P = 10 \cdot (3,6) = (5,9)$
• Publishes: $K_{pub} = (p=11, a=1, b=6, q=13, P(3,6), Q(5,9))$

Encryption (Alice sends $T = 7$):

1. Choose ephemeral $i = 5$
2. Ephemeral key: $K_E = i \cdot P = 5 \cdot (3,6) = (2,4)$
3. Masking key: $K_M = i \cdot Q = 5 \cdot (5,9) = (8,3)$
4. Encrypt: $Y = T \oplus x_{K_M} = 7 \oplus 8 = F$ (XOR of x-coordinate)
5. Send: $(Y, K_E) = (F, (2,4))$

Decryption (Bob):

1. Masking key: $K_M = d \cdot K_E = 10 \cdot (2,4) = (8,3)$
2. Decrypt: $T = Y \oplus x_{K_M} = F \oplus 8 = 7$ ✓

Key details:

• The plaintext $T$ is typically a symmetric key (AES key), not the actual message
• XOR encryption using the x-coordinate of $K_M$ as the key
• Eve sees $K_E = (2,4)$ and $Y = F$ but cannot compute $K_M$ without solving the ECDLP
• Don't confuse curve parameters $a, b$ with Alice's and Bob's secret exponents!

Go deeper:

• ElGamal encryption — Wikipedia — the general scheme this EC variant instantiates over a curve group.