An early public-key encryption built on Diffie-Hellman. Encrypted messages can be reshuffled and combined.
The idea: The recipient's public key is h = g^x. To encrypt, pick a fresh random r, send g^r, and multiply the message by h^r, which is the Diffie-Hellman secret between g^r and h. Only the holder of x can compute h^r from g^r and divide it out. Nothing is run backwards: even the recipient never learns r, so unlike RSA there is no trapdoor. Because every encryption uses a new r, the same message looks different each time, and anyone can re-randomize a ciphertext, which voting systems use to shuffle ballots so they can't be traced.
Why it matters: Popular in electronic voting systems.
On the map: re-randomizable
Encrypt m to the public key h = g^x as the pair (g^r, m × h^r) for a fresh random r[1]. It hides the message under decisional Diffie-Hellman.
Decryption inverts nothing: the key holder computes (g^r)^x = h^r and divides it out, and r stays hidden, even from them. So ElGamal itself is not a trapdoor function. It still falls if trapdoor functions are impossible: decisional DH yields one through a different, cleverer construction[2], which is why that box carries the TD tag.
Ciphertexts can be re-randomized and multiplied together, handy for e-voting mix-nets[3] and threshold decryption. For general-purpose encryption, ECIES/HPKE is used instead.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.