These formal definitions often seem far stronger than necessary for practical security — many cryptosystems used in practice do not satisfy the formal definitions. This includes typical ElGamal implementations. The attacks discussed in this paper suggest that it is worth striving to meet formal definitions of security in actual implementations. |