text:
Multiverse (Magic: The Gathering)

The Multiverse is the shared fictional universe depicted on Magic: The Gathering cards, novels, comics, and other supplemental products. Though Magic is a strategy game, an intricate storyline underlies the cards released in each expansion. On the cards, elements of this multiverse are shown in the card art and through quotations and descriptions on the bottom of most cards (called flavor text). Novels and anthologies published by HarperPrism and Wizards of the Coast (WOTC), and the comic books published by Armada Comics expand upon the settings and characters hinted at on the cards. WOTC also publishes a weekly story (most often related to the plane explored in the current expansion set) in the Magic Fiction column, previously known as Official Magic Fiction and Uncharted Realms.

In the early days of the game, the name 'Dominia' was used to describe the story multiverse, but due to confusion with the name of the plane/planet where the central events of Magic occur (Dominaria, which means "the Song of Dominia"), it fell into disuse and was replaced.

Creative origins
The way Magic storylines are conceived and deployed has changed considerably over the years. The main premise of Magic is that countless possible worlds (planes) exist in the Multiverse, and rare beings called Planeswalkers are uniquely capable of traversing the Multiverse without external aid. This allows the game to frequently change worlds so as to renew its mechanical inspiration while maintaining Planeswalkers as recurrent, common elements across worlds. Players represent Planeswalkers able to draw on the magic and entities of these planes to do battle with others.

Richard Garfield established enough of this story for the game when it was first published. With the first sets, most of this story was told through the cards' flavor text, and because most of the creatures and the keywords were based on common fantasy tropes (flying dragons, for example), there was no significant driver for a backing narrative. In some cases, the narrative was demanded to help with new gameplay mechanics and keywords that did not fit standard fantasy tropes, but these were still limited to flavor text. The first expansion Arabian Nights (1993), designed by Garfield, was based on One Thousand and One Nights folklore and included figures from that such as Aladdin.

Pre-revision era
With the demand for more expansions, several different teams within Wizards of the Coast's research and development department worked separately on these upcoming sets, with the card designers taking the lead in creating their narratives. Each of these teams had different approaches for implementing that in the cards. For example, the next expansion was Antiquities (1994), with a design led by Skaff Elias. Elias' team wanted this set to focus on the use of colorless artifacts and came up with the narrative idea of a battle between two brothers skilled in artifact use at a point in time before the other realms of magic had established themselves. This would tie into both their planned cards as well as help define the differences between the color mana schools better. Elias planned out elaborate timelines, but as the set was only 100 cards, most of this was left on paper, giving players only glimpses of the larger picture through flavor text. In the case of Homelands (1995), R&D had two writers craft a story first and then worked alongside them to implement that into the cards for that set. Still, few elements of any of these sets were shared save for the common connection to the plane of Dominaria.

Apart from Wizards' own attempts at storytelling, in 1994, Wizards gave exclusive licenses to Harper Prism to publish novels, and an imprint of Acclaim Entertainment to Armada Comics to publish comic books. Neither of these was developed in concert with the game and subsequently created divergent ideas to the game. "Much of the lore established" by Armada Comics "is the foundation from which the rest of continuity was built. In fact, the idea of 'The Revision' stemmed in part from WotC publishing novels based loosely on many of the stories told in these comics. Some of the details changed (or were 'retconned', in popular fan speak), but for the most part, the core of these stories stayed the same". The comics came to a sudden end in 1996 when Acclaim, parent company of Armada Comics, started to run into financial trouble. In 1997, "two video games connected to the comics, Shandalar and Battlemage, were also released [...]. In general, Pre-Revisionist materials are still canon unless contradicted by another source".

Pre-mending era
Wizards began to take back narrative control with the Mirage (1996) storyline. "Detailed story summaries for Mirage and Visions were available on the Wizards website, covering the events of the Mirage War. But it was with Weatherlight that Magic's first epic narrative began". Wizards wanted to try to create a more cohesive universe with the next major expansion, Weatherlight (1997), comparable to other works like Star Wars. Mark Rosewater and Michael G. Ryan developed a long-term story arc that would cross through several expansions as well as into comics, magazines, and novels. With the cards, a small team of dedicated writers was used to make sure there was a consistent voice in the flavor text to help emphasize the story elements. "The next four years, from Tempest in 1997 through Apocalypse in 2001, would follow the story of the legendary Skyship Weatherlight and her crew". This saga was intended to last the next five years, but several factors came into play by the time the Urza's block was released: there was a change in leadership in oversight of Magic: The Gathering and the direction it was heading, players were not interested in the lead characters of the saga, and players had found it difficult to follow the narrative from the cards alone.

In 1998, a new four-issue limited comic series was published by Dark Horse. Around the same time, Wizards had regained control on the license to publish novels and comics and they decided to make the novels the primary route for the story of Magic: The Gathering which would tie in closely with the cards designed for the expansion. This approach was used through the Onslaught block in 2003, after which Wizards found that novels were not a sufficient means to build out the details for cards; novels would be focused on how characters change over events, while the game presented a character at a single moment, and a novel could not flesh out all the other supporting elements that the card designers needed to build their sets without weighing down the readers.

Following Onslaught, the narrative of Magic: The Gathering took a more distanced approach. Once an idea for an expansion was presented, preliminary work was done simultaneously by the research and development team and by the creative staff to build out the basic gameplay concepts and the setting of that expansion, respectively. Once both sides agreed to that, the two teams then proceeded primarily on individual routes towards their end production. Brady Dommermuth, the Creative Director in 2006, said that "generally the cards provide the world in which the novels are set, and the novels sometimes provide characters represented on cards. But cards also introduce their own characters that might not appear in the novels. In short, the Magic creative team and the novelists work largely in parallel and inform each other as much as possible."

Post-mending era
The pre-mending and post-mending monikers come "from the event known as the Mending, which fundamentally changed the nature of Planeswalkers from near-divine beings to mortals with a bit more oomph". During this time, Wizards further transitioned to ebooks as well as having their creative staff write more in "Uncharted Realms", a weekly column on the company's website. In September 2011, Hasbro and IDW Publishing accorded to make a four-issue mini-series about Magic: The Gathering with a new story but heavily based on MTG elements and with a new Planeswalker called Dack Fayden, the story of which mainly developed in the planes of Ravnica and Innistrad. In total, between 2011 and 2014, four four-issue mini-series were published by IDW. In 2013, Wizards saw that even with continued growth in player numbers, printed novel sales had fallen greatly and ebook sales remained flat, and made the decision to discontinue the larger narrative works in favor of having the creative team provide story coverage and shipments as of the "Uncharted Realms" column.

In 2014, Mark Rosewater wrote: "Unfortunately, the public has made it very clear that novels are not how they want the story told". Clayton Emery, on why he no longer writes Magic: The Gathering novels, wrote that after being invited to Gen Con he "arrived to find waiting for me — nothing. [...] No reading, no panels, no chance to meet fans, and not a single copy of any of my books anywhere in sight. Why did you invite me? [...] While there, I did get to ask, [...] Will you guys promote my work? 'No. If you catch fire with the fans, then we'll promote you.' How do I catch fire with the fans if you don't promote my work? 'Who knows? We don't promote Magic books as a rule anyway, because they don't sell well.' Then why produce them? And hey, you promoted Jeff Grubb's latest Magic book, advertising it on the inside front cover of every DC comic for three months during one summer. 'Oh, sure. His books sell.'" Sam Keeper, for CoolStuffInc, wrote "I can't attest to the accuracy of Emery's recollections, but it certainly feels familiar. [...] None of the ebook releases, to my knowledge, have ever been acknowledged by official accounts, aside from that single link to an incomplete list on mtgstory.com. [...] Nonetheless, it's a bit of a self-fulfilling prophecy to not promote a product, and then conclude that there simply isn't an audience for it".

This approach continued through 2017. Then, Wizards of the Coast hired novelist and scriptwriter Nic Kelman as their Head of Story and Entertainment. Kelman's task was to assemble all of the lore established from previous card sets and the published novels, comics, and other materials to create the game's "cosmology" or the story bible that established all the known planes and elements of those planes, the individual Planeswalkers and their connections to others, and other details that they could be passed not only to the teams developing new cards but also to those expanding the franchise with new novels and other content. This allows for highly connected events between the external media and the game; one example established the death of a major Planeswalker in the novel War of the Spark: Ravnica that was published just prior to the release of the new set War of the Spark, the first novel published by Wizards in several years, with the set containing cards referencing that death.

In 2018, as part of MTG's 25th anniversary, IDW began publishing another four-issue comic mini-series — this time centered around the Planeswalker Chandra Nalaar. In 2018, Kelman said:"In the early days of Magic storytelling, there wasn’t necessarily a lot of communication between different storytellers, nor was there much long-term planning about where Magic story might be in 2, 5, or 10 years. Over the years, we’ve been trying to make the story more consistent in tone and voice, make the Multiverse more consistent from a cosmological perspective, and plan out stories and character appearances further in advance. In terms of emphasis, I think the early days were less about characters and more about lore. Magic has been trying to emphasize characters more and more over the years. [...] We’ve embarked on the very exciting effort to gain the same reputation for fantasy fiction that Magic has for fantasy art. To that end, we’re now hiring first-class, globally recognized fantasy authors to write our web fiction. [...] On the micro level, we try to make sure every story has at least one character who new fans can relate to without needing to know years of history and at least one character who established fans know and love. On the macro level, we try to plan out sets, settings, and stories so, over the course of any given year, there’s going to be something for everyone."In September 2019, the sequel Chandra comic series was cancelled before publication. In November 2019, War of the Spark: Forsaken (2019) was widely panned and Wizards of the Coast "canceled plans for the book that was intended for the game's next set, "Theros: Beyond Death". Then in 2020, with the Zendikar Rising (2020) set, the Magic storyline returned via story articles on the official website. A new ongoing comic series began in 2021; the first issue went "for a third printing despite it already being the highest selling Magic comic book in history".

Cosmology
In the lore of Magic the gathering the Multiverse is a collection of planes (described somewhat like pocket universes) which are usually named after the primary planet contained within them. Travel between these planes is possible, and a few powerful beings known as "Planeswalkers" are capable of traversing between them at will.

The Blind Eternities
The Blind Eternities is the term more commonly used to describe the space between the planes of reality. Filled with chaotic, raw energies such as Aether, Mana, and temporal energy, it is a place where matter and life as known within the planes of reality cannot subsist. (The only exceptions are the Planeswalkers, who briefly pass physically through it when they "walk" between planes.) As such, not much is known or understood about the Blind Eternities. Unfathomable, reality-warping cosmic horrors known as the Eldrazi are said to be born there.

Aether
Aether (previously spelled Æther) is the main type of energy filling the blind eternities, although it can also appear in variable quantities within the planes. It is inextricably associated with magic within Magic's shared fictional universe and the use of the word in several Magic cards implies that casting magic involves channeling and manipulating Aether. Similarly, "summoning" the creatures around which combat and much of gameplay in Magic revolves is described as "pulling (them) from the Aether".

Dominaria
The majority of the Magic story was set on the plane of Dominaria prior to Mirrodin, encompassing long time periods each detailed in certain card sets or books. Dominaria is a unique nexus between all the other planes of the Multiverse. Occasionally, such as in Time Spiral, the storyline returns to it.

Storylines
Each expansion set of MTG "tells a cohesive story across those sets. [...] Each new world comes with all its own themes, strife, magic, and complications. While some elements carry throughout each block (Planeswalkers can cross into other realms after all) and Magic game designers often returns to past favorites, every block is mostly a new story to hook new players while keeping Magic veterans interested".
 * The Thran: The Thran were a ancient civilization of master artificers who were destroyed by Yawgmoth and his Phyrexians (converted Thran following him) during the Thran-Phyrexian War about 5,000 years before the Brothers. They are only hinted at in the game, but J. Robert King's novel The Thran explores their culture in some depth.
 * The Brothers' War: War between Urza and Mishra, two brothers who were trained by the archaeologist and artificer Tocasia in creating magical devices based on ancient Thran technology. As their powers grew, so did their enmity, eventually erupting in an all-out war utilizing powerful constructs. Marshalling vast armies aided by their impressive machines (some of the old Thran Empire, some newly made) the brothers staged a series of battles. The war devastated the land of Terisiare on the plane of Dominaria and culminated in a world-devastating climax on the island of Argoth. This caused the Dark, climate changes which led to the Fall of the Sarpadian Empires and finally to the Ice Age. This story is the basis for the Antiquities expansion and later the Urza's Saga Block.
 * The Dark The devastation wrought by the Brothers led to the fall of many civilizations and the beginning of a Dark Age in Dominaria. The destruction of Argoth caused a nuclear winter that would later lead to the Dominarian Ice Age.  This story is portrayed in the Fallen Empires and The Dark expansions. In this age, Terisiare's survivors were bitterly opposed to magic. Tiny, insular villages dotted a wasted, goblin-infested landscape. Fanatical priests controlled a few powerful city-states. Preachers and witch-hunters hunted the countryside for the few remaining wizards. Despite this oppression, it is during this era that mortal wizards first discover the five-color nature of magic. This story is fully explained in the novel The Gathering Dark by Jeff Grubb. The following Ice Age is detailed in Eternal Ice and The Shattered Alliance, also by Jeff Grubb.
 * Fallen Empires The harsh climatic changes that followed the destruction of Argoth caused the southern continent, Sarpadia, to struggle for survival. The elves and humans of Sarpadia begin breeding primitive but adaptable subspecies: saprolings and thrulls, respectively. These creatures soon turn on their creators and terrorize the people of Sarpadia, while the Merfolk suffered an invasion of crustacean-like homarids, which benefitted from the cooling oceans. Barraged by invading orcs, goblins, homarids, thrulls, and even fungus, the civilizations of Sarpadia are destroyed, and the continent falls into darkness.
 * The Ice Age: The climate-altering effects of the devastation continued, leading to a global ice age. New empires rose and fought in the cold. Eventually, this cooling climate was reversed and life returned to normal.  This story is portrayed in the Ice Age, Alliances, and Coldsnap expansions, and in the novels Eternal Ice and Shattered Alliance by Jeff Grubb. Jeff Grubb also wrote a short story "continuing" the story for Coldsnap, which is located in the Player's Guide insert you can find in a Coldsnap Fat Pack.
 * The Homelands This short interlude depicts the decimated plane of Ulgrotha, in which many civilizations struggle for power against Baron Sengir, a powerful vampire who has manipulated a number of other characters into serving his ends. The Planeswalkers Serra and Feroz turn the balance in favor of the light, but are killed in battle against a crazed alien Planeswalker. The story has no concrete ending.
 * Jamuraa: The story concerns three of the most powerful nations of Jamuraa (a tropical continent) — the militaristic kingdom of the Zhalfirins, the religious state of Femeref, and the trading province of the Suq'Ata empire. Zhalfir was the warrior nation, based mainly on red. Femeref was mainly white, and featured clerics and healers, while the seafaring traders of Suq'Ata were mostly blue. Mirage concerned these three nations and their struggle against the evil wizard Kaervek. Kaervek has imprisoned the powerful wizard and diplomat Mangara in an amber prison and the bulk of the story details the Jamuraans attempting to free Mangara. In addition to these events, the Planeswalker Teferi has caused his island to disappear from existence for almost 200 years. It is the phasing of the entire island that led Kaervek and Mangara to Jamuraa in the first place.
 * The Phyrexian Invasion: After millennia of peace, the machine-like Phyrexians, who originate from a hellish mechanical world, invade the world of Dominaria led by the former Thran Yawgmoth from the pocket universe of Rath. The Phyrexian invasion divides into many sub-stories.
 * The Urza Saga: Following the destruction of Argoth, Urza becomes a Planeswalker and foresees the invasion of Dominaria. Urza's travels lead the war to the peaceful universe of Serra's realm which is destroyed by Phyrexian armies; survivors of the plane flee to Dominaria and Ulgrotha. In preparation for the invasion, Urza creates the Tolarian academy, research, and development laboratory school in which he and other mighty wizards train mages for the upcoming invasion and experiment on weaponry development, time travel, and genetic manipulation in hopes of creating a defensive army. The time experiments lead to a temporal collapse and the academy becomes laced with time fractures, which are both dangerous and useful to the inhabitants. Urza himself develops a fearful Legacy Weapon and Karn, a self-aware golem which, combined, can defeat any foe. This story arc is linked to The Thran, Antiquities, The Dark, Ice Age, and Homelands and is depicted in the books The Brothers War, Planeswalker and Time Streams.
 * The Legacy: This follows the travels of many brave adventurers from all across Dominaria who, aboard Urza's vessel "The Weatherlight", seek to collect the different artifacts left by Urza and necessary to assemble the Legacy Weapon. As opposed to them, many Phyrexian allies or lords will try to stop them from their quest. This story arc is the longest in the Magic continuity, and its characters are depicted in the Weatherlight, Tempest, Stronghold, Exodus, Mercadian Masques, and Nemesis card sets; later, the story continues and concludes in the Invasion arc.
 * Prophecy: Parallel to the "Legacy" history, and following the Mirage and Urza's Saga histories, in Dominaria the warrior kingdom of Keld ensues war all across Jamuraa. Many wizards from the Tolarian academy aid the federation of Jamuraa and succeed in stopping the Keldons' warmongering.
 * The Invasion: The dreaded Phyrexians finally come to Dominaria across many "planar portals" and Urza, who has been spending thousands of years planning a defense against the Invasion, implements his plans. The Weatherlight leads the Dominarian forces, but the widespread chaos, and the uncompromising nature of Urza's tactics, threaten to destroy the plane. The arrival of Yawgmoth himself leads to the Apocalypse, but he is finally defeated by the fully assembled Legacy Weapon. The Invasion itself occurs in the Invasion block but is linked to all previous story arcs. From this point on, the publishers switch to a series of self-contained plotlines with occasional links to older stories, rather than sweeping epics spanning years of card releases.
 * Odyssey: One hundred years after the devastation of the Invasion, Dominaria is still in the process of rebuilding. This part of the story takes place in Otaria, a devastated continent that was, surprisingly, the place least affected by the Invasion. It centers on Kamahl, a barbarian, and his quest to get the Mirari, a magical orb of seemingly endless power.
 * Onslaught: Having acquired the Mirari with devastating effects, Kamahl renounces it and tries to be rid of it, but the events he triggered have gone far beyond his control. The story shifts to a battle between Akroma, an angel, and Phage, Kamahl's corrupted sister, who kills with a touch. As zealous armies gather behind each of them, Kamahl needs to end their escalating conflict before Otaria itself is decimated. To this end, he recovers the slumbering Mirari and allies himself with three ancient gods who have been waiting for these events to happen again. This story is linked to Mirrodin and sets the scene for the first major storyline not set in Dominaria.
 * Mirrodin: The story of Mirrodin takes place on a new, metal world, created by the Planeswalker Karn and populated by races stolen from other worlds. Glissa, an elf, and her allies strive to assemble the mythical Kaldra, so that they can defeat the crazed Memnarch, who lives inside the hollow world. All the while, we learn about the history of Mirrodin, and it's loose, but nonetheless present, connection to previous storylines based on Dominaria. The Mirrodin story is the first of the new year-long, three-set story arcs, having started in 2003 with the release of Moons of Mirrodin and continuing with 2004's The Darksteel Eye and The Fifth Dawn.
 * The Kami War: The plane of Kamigawa is naturally divided into two: the kakuriyo Kami world (spirit world) and the utsushiyo material world; both working and operating harmoniously until the Kami began to attack the material world twenty years before the story opens. The books follow the lone samurai Toshiro Umezawa and the princess Michiko as they try to bring peace to Kamigawa. As well as giving the game an unusual, strong Oriental feel, this storyline is interesting in that the designers deliberately tried to give the story a strong influence over the game itself. Instead of relying on the traditional "color wheel" conflict (the game of Magic: the Gathering is based on a five-point circle of allied and enemy color affiliations), the color of any given card may often be less important than whether it has a Kami or Material theme.
 * Ravnica: Ravnica is a plane covered almost entirely in the cityscape. The city's ten "guilds", political organizations each based on a different two-color mana pairing, warred for a long period of time. After the conflict, a magical document, the Guildpact, was created to ensure that the plane remained at peace and that the guilds would constrain themselves to their social roles. The main storyline begins 9,999 years later, as anticipation of the decimillennial anniversary builds. The once-noble guilds have corrupted and decayed over time, and a great political gridlock is all that keeps Ravnica stable. A series of protagonists - most notably Agrus Kos, a law enforcement officer from the Boros League, and Teysa Karlov, a lawmage from the Orzhov Syndicate, uncover the plots of the various guildmasters, as well as the ambitions of the "secret guild", House Dimir. The flavor of the cards again exerted considerable influence over the mechanics of the game, encouraging players to build decks devoted to a particular guild.
 * Time Spiral: The Time Spiral block returns to a post-apocalyptic Dominaria. Teferi, a Planeswalker, abandoned Urza during the Phyrexian Invasion by "phasing" (temporarily removed from reality) two landmasses known as Shiv and Zhalfir out. He returns to Dominaria to find it in a state of ruin. In addition to having been almost totally devastated by the Apocalypse, mysterious "time rifts" have opened in the skies across the plane, making planeswalking and spellcasting more difficult. Teferi wants to ensure that Zhalfir and Shiv return to Dominaria safely - however, the time rifts, and the considerably deteriorated state of the plane itself, means that the two continents no longer "fit." Should Zhalfir and Shiv land, Dominaria and the entire Multiverse would be destroyed. The Time Spiral block was billed as Magic's nostalgia block and would revisit themes and characters from every storyline up to the end of the Otaria arc. As the Invasion did before, the Time Spiral story is linked to any other story arc before it, harkening back to many earlier settings and characters, even those outside of Dominaria. It was during this block that The Mending occurred, greatly reducing the powers of all Planeswalkers.
 * Lorwyn: Whereas most blocks consist of three sets, it was decided to turn the 2007/08 block into two mini-blocks of two sets each. The focus of the first is the plane of Lorwyn, an idyllic, perpetually sunlit world populated by a wide variety of civilized species. These tribes are generally peaceful but keen to keep to themselves. The story centers around an elf outcast named Rhys who has triggered a series of events foreseen by his mentor, Colfenor, and a flamekin pilgrim named Ashling who believes her path and Rhys's are the same. The coming Aurora, an annual event when the plane darkens and lights appear in the sky, is the key to whatever it is that Rhys needs to do.
 * Shadowmoor: Rather than passing harmlessly as it normally does, the Aurora instead transforms Lorwyn into an eerie reflection of itself. The idyllic, sunlit world is replaced by the shadows and omnipresent malice of Shadowmoor. Landscapes, races, and even individuals become twisted alternatives with no indication that their Lorwyn selves ever existed. Ashling, now known as the Extinguisher, has a central role in this shift, and it falls to Rhys (an elvish hero in this place) and Maralen, a mysterious elf and one of the very few unchanged by the transformation, to discover why.
 * Alara: The plane of Alara was shattered long ago by an unknown force; it is now split unequally into five unique shards, each having no knowledge of the others. Each shard was denied two of the five colors of magic by the event (the inhabitants of each shard have had no recollection of the missing two colors of mana for centuries), and have evolved around their remaining three: The militant, feudal, sun-dappled plane of Bant; the scientific, order-obsessed, windy and cloud covered plane of Esper; the desperate, lifeless, blackened plane of Grixis; the violent, harsh, volcanic plane of Jund; and the green, lush, stampeding plane of Naya. Many species die off, evolve, or border extinction in each shard due to insufficient mana sustenance (Zombies can't survive without black mana, angels can't survive without white mana, etc.), and others thrived. The force that shattered the plane is unknown but believed to be the five-headed hydra Progenitus (for unknown reasons) who disappears at the shattering of the plane and reappears in the expansion "Alara - Conflux" when the shards are reunited.
 * Conflux: As the Shards of Alara draw closer together, the millennia-long machinations of a hidden evil come closer to bearing a dire harvest. Nicol Bolas, once one of the most powerful Planeswalkers, has been manipulating the civilizations of Alara for his own reasons. As the shards violently collide with each other after centuries apart, war erupts on all sides, and in the chaos, Bolas seeks to harness the power of the Maelstrom, the chaotic center of the plane where all five colors come together in a magical storm of unimaginable energies and power. The Planeswalker Elspeth Tirel and the valiant knight Rafiq start to catch wind of an insidious plot and begin investigating.
 * Zendikar: A new plane is introduced: Zendikar, a world with powerful, uncontrollable mana and many dangerous features, including the Roil. Planeswalkers are drawn to Zendikar because of its powerful mana. Many of Zendikar's residents must fight against the land itself as mountains become alive and forests move. It is revealed that thousands of years ago three Planeswalkers locked powerful, unstoppable beings known as the Eldrazi in a complex prison on Zendikar, causing the plane's complex problems. When three more Planeswalkers enter the prison, the Eldrazi are released and start destroying Zendikar as they cannot escape from the plane.
 * Scars of Mirrodin: As the storyline returns to the metallic plane of Mirrodin, it is found divided. A corrupted Karn has returned and brought with him the rot of Phyrexia.  As the world faces off, Mirran versus Phyrexian, the idyllic plane is brought to a new form.  This set also marked a deviation from the five-color wheel, instead pushing players to align their decks to the Mirran or Phyrexian side of the conflict; to reinforce this, they created a website devoted to the war where the player can switch between sides. In February 2011, it was announced that Phyrexia had won, and the set New Phyrexia played out as a war amongst five Praetors of Phyrexia, battling each other for dominance.
 * Innistrad: A new plane is introduced: Innistrad, set in a gothic-themed world, where vampires, werewolves, and demons run rampant. Before the events of the block, the human population of Innistrad was constantly beset by supernatural creatures. In response, the Planeswalker Sorin created the arch-angel Avacyn to protect the humans. Avacyn set out to eradicate all of Innistrad's demons, leading to an epic battle against the elder demon, Griselbrand. During the battle, Griselbrand was able to trick Avacyn into locking both beings in the magical prison known as the Helvault. With Avacyn gone, the angel's protection disappeared and soon creatures of darkness were free to prey on mankind once more. When Sorin finds out about this he goes straight to Innistrad (presumably from Zendikar) to see what can be done. While he is searching for Avacyn, Liliana Vess is there searching for Griselbrand so she can slay him and release herself from their bargain for Liliana's soul. Liliana discovers the Hellvault and releases Griselbrand and Avacyn. Liliana slays Griselbrand, and Avacyn's restored powers guard humanity from the zombies, werewolves, and dangers of Innistrad.
 * Return to Ravnica: Returning to the megalopolis of Ravnica, the guilds have been in a state of constant warfare ever since the events of Dissension, when the Guildpact was dissolved. The Izzet League's guild leader Niv-Mizzet discovers a maze passing through the Tenth District of the city. He sets his entire guild on figuring out the point of this "Implicit Maze". It is learned later in the story that the being who traverses the maze will become the Ruler of Ravnica. Niv-Mizzet makes an announcement all over the city of Ravnica, asking all guilds to send a champion to run the maze. The Planeswalker Jace Beleren solves the mystery of the maze and lauds himself as the Living Guildpact, settling disputes for the ten guilds.
 * Theros: On a new plane, Theros, based on the heroes, myths, and monsters of Ancient Greece, Elspeth arrives and is declared the Champion of the sun god, Heliod. The Planeswalker Xenagos becomes the God of Revels, angering the established pantheon of the other Gods. Heliod gives Elspeth the Godsend, a sword with which to slay Xenagos. Ajani Goldmane, another Planeswalker, helps Elspeth to kill Xenagos. Meanwhile, the Planeswalker Kiora is searching the seas of Theros for something that will help to defeat the Eldrazi that will inevitably eventually destroy the Multiverse. The merfolk begin to worship Kiora, mistaking her for Thassa, the God of the Sea. At this point, all of the Gods of Theros are very angry at the Planeswalkers. After Elspeth kills Xenagos, Heliod takes the Godsend and kills Elspeth with it, sending Elspeth to the underworld of Theros. Ajani is angered and stays on Theros looking for a way to get even with the Gods.
 * Khans of Tarkir: A new plane (Tarkir) is the setting of this block. Tarkir is the homeworld of Sarkhan Vol, a Planeswalker known for an obsession with dragons, and the five warring clans, each aligned towards 3 colours. The Mardu (RWB), The Abzan (WBG), The Jeskai (URW), The Sultai (BGU) and the Temur (GUR). All dragons have gone extinct on Tarkir, hunted to extinction by the 5 clans many years ago, but Sarkhan returns to find the source of the voice within his mind. The Planeswalker Sorin also comes to Tarkir where he discovers that Ugin, one of the Planeswalkers that helped to seal the Eldrazi on Zendikar, has died many years ago. Sorin leaves Tarkir saddened by this loss. With the help of the Jeskai leader Narset, Sarkhan makes his way to the resting place of Ugin and travels back in time through the Nexus (the remains of Ugin form this Nexus) but not before he sees Narset killed by Zurgo Helmsmasher, Khan of the Mardu.
 * Fate Reforged: Sarkhan travels through the Nexus 1000 years into the past and discovers the world of Tarkir before the fall of the Dragons. He discovers that the Dragons are formed within great tempests and that these tempests are powered by Ugin himself. He arrives in time to see Ugin confront his nemesis Nicol Bolas, Sarkhan's old master (although at this point in time Nicol Bolas had not met Sarkhan yet). Sarkhan sees Nicol Bolas kill Ugin and leave Tarkir, leaving Sarkhan distraught that he could not save the great Dragon. Using the power of the Hedron he had recovered from Zendikar, Sarkhan encases Ugin within a cocoon of Hedrons and seals him away to save his life. This act changes the future history of Tarkir, as with Ugin still alive the Dragon Tempests would never end, preventing the humans from hunting the Dragons into extinction. Due to his actions changing his own past, Sarkhan is pulled from the past Tarkir and back into the present.
 * Dragons of Tarkir: Sarkhan returns to the present day Tarkir to find the Dragons have survived and now live together with the humans. Although the 5 clans still clash with each other, they are now led by the powerful Dragon Lords instead of the human Khans of Sarkhan's own past. He sees many people he knew from his own timeline, however, none of them remember him and all have changed as Sarkhan's actions have influenced this new Tarkir. Sarkhan travels again to the resting place of Ugin and discovers the revived Elder Dragon is gone. He cannot sense Ugin's power in his plane but takes refuge in the fact that Ugin is safe. Sarkhan then goes to find Narset where he discovers his old friend has now left the confines of the Dragons Clans and has learnt the secret history of Tarkir, including the history of Sarkhan himself. We also learn that Narset's spark has ignited and she has become a Planeswalker. We leave the pair on Tarkir, neither of them intending to leave for a long time, with too much to see and learn upon the reinvigorated plane of Tarkir.
 * Battle for Zendikar: The set picks up the storyline of Zendikar where the released Eldrazi devastate the plane. Ulamog, one of the 3 released Eldrazi titans, slowly consumes the land itself. The Zendikari population either flees or unites their strength to fight the Eldrazi together under the leadership of the Planeswalker Gideon Jura. Gideon also convinces Jace on Ravnica to help Zendikar. Jace agrees, also since he is partly responsible for releasing the Eldrazi from their prison. He is convinced that the hedrons and leylines of the plane are the keys to imprisoning the Eldrazi once again. The Planeswalker Nissa with her unique connection to the plane itself and Kiora, with the weapon she stole from Thassa on Theros, joins the fight as well. With joint forces, the Planeswalker and the Zendikari build a trap of aligned hedrons. For a moment they can imprison Ulamog again, but they were sabotaged by the reignited Demon Planeswalker Ob Nixilis who frees Ulamog, seeking revenge on Nissa and destruction of the plane he despises. He awakens Kozilek as well leaving the Plane with two ravaging Eldazi titans.
 * Shadows over Innistrad: The denizens of Innistrad are beset on all sides. Their faith in the archangel Avacyn brought them strength when fighting against demons, werewolves, vampires, and all manners of horrors.  But, now the mighty protector of the plane has been twisted into something monstrous by an outside influence.  A very familiar force has stepped into the gothic world, and its corrupting tendrils now touch everything.  The next set, Eldritch Moon, focuses on the fact that Emrakul, the most powerful Eldrazi titan who had been missing from the Battle for Zendikar storyline, is now on Innistrad. Together, the Gatewatch must find a way to save the plane from Emrakul's influence. This story also focuses on cosmic horror instead of the traditional gothic horror of old Innistrad.
 * Kaladesh: The Gatewatch goes to Chandra Nalaar's home world, the titular plane of Kaladesh, where she finds her mother (presumed dead) and almost kills Tezzeret. Tezzeret later kidnaps Rashmi, winner of the famous Inventor's Fair, and begins a dastardly plot to control the ruling Consulate. With the Consulate imprisoning inventors and confiscating their devices following the Fair, tensions between the populace and the government reach a boiling point, as depicted in Aether Revolt. The block focuses on a Steampunk aesthetic, with the steam replaced by the powerful material aether.
 * Amonkhet: The Gatewatch set out to destroy the evil dragon Planeswalker Nicol Bolas after learning of his dominion over the titular desert plane Amonkhet. In the desert, they find a city (Naktamun) teeming with food, water, and life, ruled by five gods, with Bolas seemingly absent altogether. The people of Naktamun train their entire lives to die in ritual combat, hoping to experience pure bliss in the afterlife when the God-Pharaoh (Bolas) returns to Amonkhet. In Hour of Devastation, Bolas returns as prophesied, only to raze Naktamun and reveal the true purpose of the training and combat: to create an army of physically perfect and combat-adept mummies to serve as an unquestionably loyal army. The block's setting is based on ancient Egypt, with themes of social hierarchy and contrast between life and death.
 * Ixalan: The plane is home to four primary tribes, each with distinct synergies and advantages that draw off of one another. As for the tale: the golden city of Orazca, buried deep in the jungle, houses a great secret.  The immortal sun, an artifact of immense power, is hidden there.  Now, that secret has become known.  The great forces of the plane gather to combat one another in a contest to see who will claim the mighty prize.  The merfolk River Heralds, the vampiric Legion of Dusk, the Brazen Coalition of pirates, and the Sun Empire's dinosaur riders all meet in open conflict to decide the fate of their world.
 * Dominaria: A return to the place of so many of Magic: The Gathering's storylines in celebration of the game's 25th anniversary.

Additional plots
There are numerous other smaller plots and subplots that take place in Dominaria and on the many planes of the multiverse of Dominia as well as events after the invasion of Dominaria by the Phyrexians.

 * The sets from Weatherlight up to Apocalypse follow the epic story arc of the crew of the airship Weatherlight, their trek across several planes, and their ultimate role in defending Dominaria from the Phyrexian invasion.
 * The sets from Odyssey to Scourge, set in the era of upheaval after the Invasion, involve the Dominarian continent of Otaria and the struggle between various factions for the powerful artifact known as the Mirari.
 * The sets from Mirrodin to Fifth Dawn are set in the world of Mirrodin, where artificial and natural life are inseparably entwined.
 * Several Magic: The Gathering video games have their own storylines and worlds.
 * Starting with The Mending during Time Spiral, many of the stories revolve around the newly created, de-powered Planeswalkers. These characters recur in multiple sets, and may receive reprints or entirely new cards in new sets.

Reception
In 2016, Cameron Kunzelman, for Paste, highlighted the Kaladesh storyline and wrote: "This might be the appropriate time to say that the Kaladesh leans very hard into the visual stylings of a fantastical, pre-colonial India (as one of the set’s key characters, Saheeli Rai, might suggest). While I can’t speak to how successful they have been at synthesizing the cultural references with the fantasy elements, my general impression is that the gesture toward Indian culture is just that: a vague gesture. I’ve yet to see a card that really felt like it “landed” in that cultural space. At the same time, Magic has gotten better and better at melding the mechanical elements of the game with the narrative ones, and Kaladesh is the best that this current formation of the company has done so far".

In 2018, Kunzelman, for Kotaku, highlighted a card from 1993 that was reprinted as part of the 25th anniversary — the newer card now has an elaboration on how it connects to the Planeswalker, Liliana Vess. Kunzelman wrote: "This is the smallest trickle of narrative, literally buried at the bottom of a card, and yet it allows a player who is familiar with the game to grasp onto it and get a huge amount of new contextual information about the world [...]. It’s a really great touch that makes a world that we access through card stock feel like it is a living, breathing world with its own mythology that we’ve been living in for the past 25 years. That’s the real selling point of this kind of contextual storytelling on collectable cards for me. [...] This story, appearing on the bottom of a card and giving a whole new dimension to a narrative I’m already familiar with, sells me on the idea that all the pieces matter. Each card is a piece of a larger world, and I’m supposed to pay attention to them and connect them up like breadcrumbs".

Aidan Moher, for Tor.com, wrote "Magic’s storytelling has come a long way from its early days. It’s no longer a plain fantasy world filled with generic tchotchkes and epic fantasy tropes. It’s grown into something way bigger and more expansive than Richard Garfield, the game’s creator could have ever imagined. Magic was my gateway into fantasy—and as an adult, I’m stilled thrilled by its ever-expanding world. [...] It’s also an experience shared by the game’s millions of players—a story of community and hope, overcoming odds, coming together over a shared love of the game, and, of course, blasting dragons with lightning bolts".

In 2018, Sam Keeper, for CoolStuffInc, wrote "It's bewildering that the main website of this game offers no comprehensive list of all the art books, novels, comics, and webcomics, with new releases coming out this very week highlighted and promoted all over every relevant article. This is the kind of thing bloggers and webcomic artists recognize the need to establish, so why does a company owned by Hasbro have such a disorganized back-and-current catalog? For goodness sake, this has actually gotten worse recently, with the former list of ebooks getting killed in the still buggy and archive-destroying site redesign a few years back. Even that, mind, was a bizarre mess, with single books missing from trilogies on different platforms, and no mention of Godsend, which had come out a month before this archive capture. Wizards seem to want to turn the storyline, somehow, into a global franchise and brand, but they seem pathologically unwilling to pay for the venture. [...] Certainly, it's hard to feel very invested in a fandom where I feel so little like I know what's going on, what is being released when, and how to actually give Wizards of the Coast my dang money!"

Dungeons & Dragons
The Magic Multiverse as a setting for Dungeons & Dragons was officially added to the game in November 2018.

title: Multiverse (Magic: The Gathering)


text:
MTG

Mtg is as an abbreviation for the words "meeting" and "mortgage".

MTG may also refer to:

Businesses and organizations

 * Mağusa Türk Gücü S.K., a Turkish Cypriot sports club
 * Maria-Theresia-Gymnasium, a Munich school for gifted students
 * Metalogenia, a ground engaging tools company based in Spain
 * Metro Tunneling Group, joint venture of Five Companies
 * Modern Times Group, a Swedish media company and owner of Viasat and Metro International
 * MTG Hawke's Bay, a museum, art gallery and theatre in New Zealand
 * Servicios Aéreos MTT	(ICAO airline code ), a Mexican airline; see List of airline codes

Science and technology

 * Methanol to gasoline, a process for producing liquid hydrocarbons from methanol
 * Middle temporal gyrus, a region in the brain
 * Meteosat Third Generation, geostationary meteorological satellites built for EUMETSAT
 * Monothioglycerol, a thiol used in mass spectrometry and cell culturing

Places

 * Mato Grosso Airport (IATA airport code ), Mato Grosso, Brazil; see List of airports by IATA airport code: M
 * Mottingham railway station (station code ), London, England, National Rail station code

Other

 * Goliath language (ISO 639 language code )
 * Magic: The Gathering, a trading card game
 * Marjorie Taylor Greene (born 1974), Republican member of the United States House of Representatives
 * MTG (2023) - A biography by Marjorie Taylor Greene
 * Mind the Gap, a train announcement
 * Man the Guns, an expansion for the strategy game Hearts of Iron IV

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: MTG


text:
Gillian Chan

Gillian Chan (born 1954) is a Canadian children's author who lives in Dundas, Ontario.

She was educated at Orange Hill Grammar School and the University of East Anglia (BEd, 1980).

Chan is also the author of a short diary entry of Chin Mei-ling's during the Christmas week a year or so after the original diary ended for the Christmas treasury from the Dear Canada series, A Season for Miracles: Twelve Tales of Christmas.

On October 27, 2006, Chan competed on the television show Jeopardy!, finishing in last place.

Works

 * Golden Girl and Other Stories - 1994
 * Glory Days and Other Stories - 1996 (Nominated for a Governor General's Award)
 * The Carved Box - 2001
 * A Foreign Field - 2002
 * An Ocean Apart: The Gold Mountain Diary of Chin Mei-ling (Dear Canada) - 2004
 * The Turning - 2005
 * I Am Canada: A Call to Battle - 2012

title: Gillian Chan


text:
Fall Rot

Fall Rot (Case Red) was the plan for a German military operation after the success of Fall Gelb (Case Yellow), the Battle of France, an invasion of the Benelux countries and northern France. The Allied armies had been defeated and pushed back in the north to the Channel coast, which culminated in the Dunkirk evacuation. The operation to complete the conquest of France by the German Army began on 5 June 1940. Fall Rot began with a preliminary attack over the river Somme on the Channel Coast to the Seine, beginning on 5 June and the main offensive by Army Group A on 9 June further east over the river Aisne.

French defensive preparations
By the end of May 1940, the best-equipped French armies had been sent north and lost in Fall Gelb and the evacuation from Dunkirk, which cost the Allies 61 divisions. French commander Maxime Weygand was faced with the prospect of defending a 965 km front from Sedan, along the Aisne and Somme rivers to Abbeville on the Channel, with 64 French divisions. The 51st (Highland) Infantry Division and a few British divisions being sent to French ports south of the Somme to form the "2nd BEF" were the only British contribution. Weygand lacked reserves to counter a breakthrough against 142 German divisions and the Luftwaffe, which had air supremacy, except over the English Channel.

Between six and ten million civilian refugees had fled the fighting and clogged the roads, in what became known as L'Éxode (The Exodus) and few arrangements had been made for their reception. The population of Chartres declined from 23,000 to 800 and Lille from 200,000 to 20,000, while cities in the south such as Pau and Bordeaux rapidly grew in size.

Battle of Abbeville
The Battle of Abbeville took place from the 28 May to 4 June 1940 near Abbeville during the Battle of France in the Second World War. While Operation Dynamo, the Dunkirk evacuation, was under way, Weygand tried to exploit the immobilisation of German forces, to attack northwards over the Somme and rescue the trapped Allied forces in the Dunkirk pocket. The attack was carried out by the French 2e Division cuirassée (2nd DCr, heavy armoured division) and 4e Division cuirassée (4th DCr) and the British 1st Armoured Division. The attacks reduced the size of the German bridgehead by about 50 per cent.

Weygand line
The French armies had fallen back on their lines of supply and communications and had easier access to repair shops, supply dumps and stores. About 112,000 evacuated French soldiers were repatriated via the Normandy and the Brittany ports. It was some substitute for the lost divisions in Flanders. The French were also able to make good a significant amount of their armoured/armored losses and raised the 1st and 2nd DCr; the 4th DCr also had its losses replaced; morale rose and was very high by the end of May 1940.

Morale improved because most French soldiers knew of German success only by hearsay; surviving French officers had gained tactical experience against German mobile units and had increased confidence in their weapons, after seeing their artillery (which the post-battle analysis of the Wehrmacht recognised as technically excellent) and tanks perform better in combat than German armour. The French tanks had heavier armour/armor and bigger guns. Between 23 and 28 May, the French reconstituted the Seventh and Tenth armies. Weygand decided on hedgehog tactics, in defence in depth, to inflict maximum attrition on German units. He employed units in towns and small villages, which were prepared for all-round defence. Behind that, the new infantry, armoured and half-mechanised divisions were ready to counter-attack and relieve the surrounded units, which were ordered to hold out at all costs.

Battle
Army Group B attacked either side of Paris; in its 47 divisions it had the majority of the mobile units. After 48 hours, the Germans had not broken through the French defence. On the Aisne, the XVI Panzerkorps (General Erich Hoepner) employed over 1,000 armoured fighting vehicles (AFVs) in two panzer divisions and a motorised division against the French. The assault was crude and Hoepner lost 80 out of 500 AFVs in the first attack. The German 4th Army had captured bridgeheads over the Somme but the Germans struggled to get over the Aisne as the French defence in depth frustrated the crossing. At Amiens, the Germans were repeatedly driven back by powerful French artillery concentrations, a marked improvement in French tactics.

The German Army relied on the Luftwaffe to silence French artillery as the German infantry inched forward, only forcing crossings on the third day. The Armée de l'Air (French Air Force) attempted to bomb them but failed. German sources acknowledged the battle was "hard and costly in lives, the enemy putting up severe resistance, particularly in the woods and tree lines continuing the fight when our troops had pushed past the point of resistance". South of Abbeville, the French Tenth Army (General Robert Altmayer) had its front broken and it was forced to retreat to Rouen and southwards over the Seine river. The 7th Panzer Division headed west over the Seine river through Normandy and captured the port of Cherbourg on 18 June, forcing the surrender of much of the 51st (Highland) Division on 12 June. German spearheads were overextended and vulnerable to counter strokes but the Luftwaffe denied the French the ability to concentrate and the fear of air attack negated their mass and mobile use by Weygand.

On 10 June, the French government declared Paris an open city. The German 18th Army advanced on Paris against determined French opposition but the line was broken in several places. Weygand asserted it would not take long for the French Army to disintegrate. On 13 June, Churchill attended a meeting of the Anglo-French Supreme War Council at Tours. He suggested a Franco-British Union, which the French rejected. On 14 June, Paris fell and the Parisians unable to flee the city found that in most cases the Germans were extremely well mannered.

The air superiority established by the Luftwaffe became air supremacy, with the Armée de l'Air on the verge of collapse. The French had only just begun to make the majority of bomber sorties; between 5 and 9 June during Operation Paula, when over 1,815 sorties were flown, 518 by bombers. The number of sorties flown declined as losses became impossible to replace. The RAF attempted to divert the attention of the Luftwaffe with 660 sorties flown against targets over the Dunkirk area but lost many aircraft; on 21 June, 37 Bristol Blenheims were destroyed. After 9 June, French aerial resistance virtually ceased and some surviving aircraft withdrew to French North Africa. Luftwaffe attacks concentrated on the direct and indirect support of the army. The Luftwaffe attacked lines of resistance which then quickly collapsed under armoured attack.

Maginot Line
Army Group C in the east was to help Army Group A to encircle and capture the French forces on the Maginot Line. The goal of the operation was to envelop the Metz region, with its fortifications, to prevent a French counter-offensive from Alsace against the German line on the Somme. The XIX Panzerkorps (General Heinz Guderian) was to advance to the French border with Switzerland and trap the French forces in the Vosges Mountains while the XVI Panzerkorps attacked the Maginot Line from the west, into its vulnerable rear to take the cities of Verdun, Toul and Metz. The French had moved the 2nd Army Group from the Alsace and Lorraine to the Weygand line on the Somme, leaving only small forces guarding the Maginot Line. After Army Group B had begun its offensive against Paris and into Normandy, Army Group A began its advance into the rear of the Maginot Line. On 15 June, Army Group C launched Operation Tiger, a frontal assault across the Rhine into France.

German attempts to break the Maginot Line prior to Tiger had failed. One assault lasted for eight hours at the north end of the line, costing the Germans 46 dead and 251 wounded for two French were killed at Ouvrage Ferme Chappy (Chappy Farm shelter) and one at Ouvrage Fermont. On 15 June, the last well-equipped French forces, including the Fourth Army, were preparing to leave as the Germans struck; only a skeleton force held the line. The Germans greatly outnumbered the French and could call upon I Armeekorps of seven divisions and 1,000 guns, although most were First World War vintage and could not penetrate the thick armour of the fortresses. Only 88 mm guns were effective and 16 were allocated to the operation; 150 mm guns and eight railway batteries were also employed. The Luftwaffe deployed Fliegerkorps V.

The battle was difficult and slow progress was made against strong French resistance but the fortresses were overcome one by one. Ouvrage Schoenenbourg fired 15,802 75 mm rounds at German infantry. It was the most bombarded of all the French positions but its armour protected it from fatal damage. The same day that Tiger began, Unternehmen Kleiner Bär started. Five assault divisions of the VII Armeekorps crossed the Rhine into the Colmar area with a view to advancing to the Vosges Mountains. It had 400 artillery pieces including heavy artillery and mortars. The French 104th Division and 105th Division were driven back into the Vosges Mountains on 17 June. On the same day, XIX Korps reached the Swiss border and the Maginot defences were cut off from France. Most units surrendered on 25 June and the Germans claimed to have taken 500,000 prisoners. Some main fortresses continued the fight, despite appeals for surrender. The last fort did not surrender until 10 July and then only under protest and after a request from General Alphonse Georges. Of the 58 big fortifications on the Maginot Line, ten were captured by the German army.

Second BEF evacuation
The evacuation of the second BEF took place during Operation Aerial between 15 and 25 June. The Luftwaffe, with complete domination of the French skies, was determined to prevent more Allied evacuations after the Dunkirk debacle. Fliegerkorps I was assigned to the Normandy and Brittany sectors. On 9 and 10 June, the port of Cherbourg was subject to 15 tonnes of German bombs, while Le Havre received 10 bombing attacks that sank 2,949 GRT of escaping Allied shipping. On 17 June, Junkers Ju 88s (mainly from Kampfgeschwader 30) sank a "10,000 tonne ship" which was the 16,243 GRT liner RMS Lancastria off St Nazaire, killing some 4,000 Allied personnel (nearly doubling the British killed in the Battle of France), yet the Luftwaffe failed to prevent the evacuation of some 190,000–200,000 Allied personnel.

Armistice
Discouraged by the hostile reaction in the cabinet to a British proposal for a Franco-British Union and believing his ministers no longer supported him, Prime Minister Paul Reynaud resigned on 16 June. He was succeeded by Marshal Philippe Pétain, who delivered a radio address to the French people, announcing his intention to ask for an armistice with Germany. When Hitler received word from the French government that they wished to negotiate an armistice, he selected the Forest of Compiègne, the site of the 1918 Armistice, as the venue. On 21 June 1940, Hitler visited the site to start the negotiations, which took place in the railway carriage in which the 1918 Armistice was signed. After listening to the preamble, Hitler left the carriage in a calculated gesture of disdain for the French delegates and negotiations were turned over to Wilhelm Keitel, the Chief of Staff of Oberkommando der Wehrmacht (OKW). The armistice was signed on the next day at 6:36 p.m. (French time), by General Keitel for Germany and General Charles Huntziger for France and came into effect at 12:35 a.m. on 25 June, once the Franco-Italian Armistice had been signed, at 6:35 p.m. on 24 June, near Rome.

Italy
Italy declared war on France and Britain on the evening of 10 June, to take effect just after midnight. The two sides exchanged air raids on the first day of war but little transpired on the Alpine front, since both France and Italy had adopted a defensive strategy. There was some skirmishing between patrols and the French forts of the Ligne Alpine exchanged fire with their Italian counterparts of the Vallo Alpino. On 17 June, France announced that it would seek an armistice with Germany and on 21 June, with a Franco-German armistice about to be signed, the Italians launched a general offensive all along the Alpine front, with the main attack in the northern sector and a secondary advance along the coast. The offensive was conducted by 32 Italian divisions and penetrated a few kilometres into French territory, against the Army of the Alps (General René Olry) which held the frontier with three divisions. The coastal town of Menton was captured but on the Côte d'Azur the invasion was held up by a French NCO and seven men. On the evening of 24 June, a Franco-Italian Armistice was signed at Rome and came into effect at the same time as the Second Armistice at Compiègne with Germany (22 June), just after midnight on 25 June.

title: Fall Rot


text:
Talk:ElGamal encryption

The article looks broken, can anybody clean it up? --MrNightLifeLover (talk) 16:30, 21 November 2008 (UTC) We should point out that without padding Elgamal is malleable. --Imran

Should be named??
The title of this article is misleading and should be changed. This is an algorithm, a primitive used to build crypto systems. It is not itself a crypto system. Perhaps a pointer from this title to this article under the better title of 'ElGamal encryption algorithm'. See the cross reference (currently a dangling link) at article cryptography. user ww

 * I agree. ElGamal is not a complete cryptosystem. Taw 19:58, 6 Apr 2004 (UTC)

 * Any suggestions for a better name? — Matt 02:36, 3 Aug 2004 (UTC)

 * It depends on how you define "cryptosystem." To theorists, a cryptosystem is rigorously defined to be a key generator, encryption algorithm, and decryption algorithm.  ElGamal fits the bill...  On the other hand, I dislike the phrase "discrete log" in the title.  Security of ElGamal surely relies on the discrete log assumption, but in fact it needs something stronger (the Decisional Diffie-Hellman assumption, to be precise).  --Chris Peikert 22:10, 18 Nov 2004 (UTC)

 * Chris, while you're right about cryptosystem in a strict sense, the term is used far more by applied crypto people than theory people, so IMHO wikipedia should use that definition. Arvindn 22:45, 19 Nov 2004 (UTC)

 * How about ElGamal cryptosystem then (also applying the principle that shorter names are better)? — Matt 23:31, 19 Nov 2004 (UTC)

 * I am OK with either ElGamal cryptosystem or ElGamal encryption or ElGamal encryption algorithm. I think Arvindn's right that cryptosystem, at least on wikipedia, should be reserved to mean a "full package".  --Chris Peikert 06:33, 22 Nov 2004 (UTC)

 * OK, I've plumped for ElGamal encryption and added redirects for the others. — Matt 07:02, 22 Nov 2004 (UTC)

In my opinion the name should be Elgamal cryptosystem. That is the name I used for the german version of the article (Elgamal-Kryptosystem) from which this text is translated. Encryption is misleading, because the text both explains the encryption and decription (I hope this is correct english :-). A cryptosystem perhaps includes encryption and decription. As far as I know the name is spelled "Elgamal" and not "ElGamal".Stern 23:21, 30 Jan 2005 (UTC)

Which algorithm is described here, anyway????
It would seem to me that the algo that is described is the DH encryption, not the ElGamal signature scheme on which DSA is based. user mmy

ElGamal Encryption is based on Diffie-Hellman. ElGamal signatures are a completely different algorithm, and they're indeed similar to DSA and Schnorr signatures. — Preceding unsigned comment added by 2A02:908:1A0:FCA0:1973:6D78:5F52:4AB9 (talk) 13:21, 23 March 2016 (UTC)

error in el-gamal decryption scheme
hello there, the very simple explanation for decrytpting the message m:=(c1,c2) with c2/(c1^x) is apparently not correct.

here is a little example:

Bob:

p:= 11; phi(11) = 10; 10=2*5;

g:=2 (2^5 mod 11 !=1 and 2^2 mod p !=1 and therefore order(2,11)=10)

x:= 5 (0<=x<p-1)

y:= g^x = 2^5 mod 11 = 10;

now PK(p,g,y) = (11,2,10) and SK(11,2,5) = (p,g,x)

Alice:

encrypts m:=7 with randomly chosen k:=9

c:=(g^k,m*y^k) = (2^9 mod 11, 7*10^9 mod 11) = (c1,c2) = (6,4)

and sends (c1,c2)

Bob:

tries to decrypt with in your opinion:

m:= c2/c1^x = 4/6^5 mod 11 = 4/10 != 7

while the original intention was:

m:=(c1^x)^-1 * c2 = (c1^-1)^x * c2 = c1^-x * c2

where ^-1 refers to the inverse of c1 in Z11

therefore:

m:= ([6]^-1)^5 * [4] = ([2]^5 *[4]) = 32 mod 11 * 4 mod 11 = 7

note: 2*6 mod 11 = 1 and then again 2 is the inverse of 6

we hope that helps

How did you calculate this? m:= c2/c1^x = 4/6^5 mod 11 = 4/10 != 7

Note: under division / we DO understand modular inverse: 4/10=4/(-1)=4*(-1)=-4=7 — Preceding unsigned comment added by 157.193.2.198 (talk) 23:15, 15 June 2011 (UTC)

Many fixes needed in this article
The description of ElGamal is incomplete and has some errors.

First, there isn't any discussion of how the parameters p,g are generated. In fact, p should be chosen to be prime, such that p-1 has a large prime factor q (p=2q+1, where q is also prime, is a typical choice). Then g should be chosen to have order q in Z_p. That is, g is not a generator of all of Z_p, but is a generator of a prime-order subgroup of Z_p. If setup is not done this way, ElGamal can be insecure (at least, according to the definition of semantic security).

(The incomplete description of the parameters may be the reason for the bug described above; I haven't looked at it closely.)

Key setup (the choice of x) is merged into the encryption algorithm when it shouldn't be. Also, it should be said that x is chosen at random from Z_q^*.

Bob's message should not be encoded as an arbitrary element of Z_p, but as an element from the subgroup generated by g. Otherwise the scheme may be insecure.

Bob's choice of k should be random from Z_q^*.

It is claimed that breaking the security of ElGamal is as hard as finding discrete logs. This is not known to be true, nor believed to be true. In fact, breaking the semantic security of ElGamal is equivalent to breaking the Decisional Diffie-Hellman (DDH) assumption in the subgroup pf Z_p generated by g.

--Chris Peikert 22:29, 18 Nov 2004 (UTC)

 * I have translated the German version of the article, but given the accuracy concerns, this should be merged in by someone with a little more knowledge -- for now, it is just there at the end of the article. Mpolo 16:35, Nov 21, 2004 (UTC)

 * Thanks -- unfortunately, it appears that the German version has many of the same errors that I describe above. One of these days when I have time I will attempt to fix this article... --Chris Peikert 21:34, 21 Nov 2004 (UTC)
 * That'd be much appreciated, if you have the time. — Matt 21:40, 21 Nov 2004 (UTC)

Fixed this article
Hi all, I rewrote this article with accuracy and security in mind, and I think it is alright now (two of the edits I accidentally submitted as anonymous, rather than via my account). I included discussions of malleability (as suggested above) and efficiency (from the German translation).

However, I haven't done my homework vis-a-vis links to other wiki pages. It would be great if someone could go through the text and take advantage of good linking opportunities.

--Chris Peikert 06:29, 22 Nov 2004 (UTC)

 * Thanks, it's great work. I've gone through and added a few wikilinks. — Matt 07:02, 22 Nov 2004 (UTC)

A few questions
I think r should be equal to gk (mod p).

Why do you say hcf (highest common factor) ? Most people talk of GCD or Greatest common divisor. You should link to Extended Euclidean algorithm. -- Nroets 8 July 2005 11:26 (UTC)

ElGamal signatures vs. ElGamal encryption
It didn't make sense to have ElGamal signatures and ElGamal encryption on the same page. There are not many similarities between the two schemes other than both are by Taher ElGamal and are based on discrete logarithm. But there are many differences between the schemes, especially when one looks at the the parameter choices. For example choosing g=2 is ok for the encryption scheme but an insecure choise for the signature scheme. A group for which the Decision Diffie Hellman problem is solvable is a problem for the encryption scheme but not a problem for the signature scheme.
 * Yep, sounds like the right thing to do. — Matt Crypto 21:36, 22 July 2005 (UTC)

Spelling
The name is spelled Elgamal, not ElGamal. Stern 19:00, 31 July 2005 (UTC)
 * See Talk:Taher Elgamal for further discussion. I agree with Matt on this one. It's referred to virtually everywhere as "ElGamal". alerante ✆ 00:14, 19 October 2005 (UTC)

 * Wikipedia goes with most common usage (see Use common names). All major textbooks I've seen spells this ElGamal, so that is what this article should be named. I agree with User:Matt Crypto and User:Alerante. —Lowellian (reply) 03:20, 20 October 2005 (UTC)

Encryption questions
I'm trying to relate the generalized description in the article to with specific implementations of encryption (like in GnuPG and Applied Cryptography), and I'm wondering about the following:

The article says, Bob chooses a random $$y$$ from $$\{0, \ldots, q-1\}$$, then calculates.... The implementations I've seen ensure that $$y$$ and $$p-1$$ are relatively prime. Is this somehow implicit in the article's description?

Also, there is a warning that care must be taken to properly encode the message $$m$$ as an element of $$G$$, and not, say, as just an arbitrary element of $$Z_p$$. How exactly can one do that? (I'm asking about using subgroups of $$Z_p$$, not elliptic curves.) Wmahan. 07:12, 26 May 2006 (UTC)

 * To your first question: When using a group $$G$$ whose order is a prime q (as recommended in the article) then one should choose y randomly in the interval 0..q-1. Then gy will be a random element in $$G$$. The restriction that y is chosen relatively prime in GnuPG is a leftover from sharing code between ElGamal signatures and ElGamal encryption. These two schemes are actually quite different when one considers security requirements. For ElGamal signatures to work one must choose y (rsp. the identifier k is used there) relatively prime to the group order. No such requirement is necessary for ElGamal encryption. Thus sharing code is a risky idea and lead for example to a very severe attack against GnuPG discovered by Phong Nguyen.

 * To your second question: You can for example choose p=2q+1 where both p and q are prime. Then choose G as the multiplicative subgroup of $$Z_p$$ of order q i.e. the quadratic residues. Now messages m in the range 1..q can be mapped into G by mapping m to $$m\left({m\over p}\right)$$ where $$\left({m\over p}\right)$$ is a Legendre symbol. Also note that the resulting cryptosystme is only semantically secure, but not secure against chosen ciphertext attacks. Thus more considerations on the padding would be necessary for a real life implementation. 62.167.39.178 19:53, 28 May 2006 (UTC)

Thank you very much. The second edition of Schneier's Applied Cryptography (1996) says to do the relatively prime thing for encryption too, not just for signing. But I checked the reference linked at the bottom of the article and it says you're right, of course. I suppose GnuPG's extra constraint on y doesn't weaken the algorithm, even if it isn't necessary. Thanks again for the informative answers. Wmahan. 19:01, 31 May 2006 (UTC)

 * perhaps the above could be added to the article. Since its not always easy to test if a elemet in $$Z_p^*$$ is in the subgroup generated by g. --The preceding unsigned comment was added by 131.130.79.169 (talk) 11:23, 19 December 2006 (UTC).

big problems
the mods are left off the equations. how is anyone going to know how to use this? --The preceding unsigned comment was added by 155.91.28.232 (talk) 23:42, 14 March 2007 (UTC).

 * No. There are not mod operations missing. The article is written in a general form using a group G written multiplicatively. If G is the multiplicative subgroup $$F_p^*$$ then all operations are done modulo $$p$$. However, G can be some other group, e.g. the group of points on an elliptic curve. 85.2.121.89 12:20, 24 March 2007 (UTC)

insecurity of G := F_p^*
I have tagged this statement as "citation needed". The currently referenced "Handbook of Applied Cryptography" specifically states that ElGamal with G=F_p^* is believed to be secure. If this information is out of date, a reference should be supplied to show that.

Also note that some current implementations do use F_p^*, so this is quite important to get right! Mbays 18:49, 22 March 2007 (UTC)

 * Good point. The statement is at least ambigous, because the term "insecure" itself is unclear without stating an adversarial model. First, the DDH assumption in $$F_p^*$$ does indeed not hold, because for a generator $$g$$ it is possible to distinguish tuples $$g^a,g^b,g^{ab}$$ from $$g^a,g^b,g^c$$ with a nonnegligible probability, by computing Legendre symbols of the values. Similarly, from an encryption $$(g^r, y^r m)$$ we can derive the Legendre symbol of $$m$$ as follows. Computing the Legendre symbol $$(g^r|p)$$ tells us if $$r$$ is odd or even. The Legendre symbol $$(y|p) = (g^x|p)$$ tells us whether $$x$$ is odd or even. Thus we know the parity of $$x r$$ and thus also the value of $$(y^r|p)$$. Hence, we know the Legendre symbol $$(m|p)=(y^r m|p)/(y^r|p)$$. Hence ElGamal encryption over $$F_p^*$$ is not semantically secure. Note that if RSA has a same problem when used without padding. Given $$c=m^e \bmod{n}$$ one can easily derive the Jacobi symbol $$(m|n)=(c|n)$$. Using prime order subgroups instead of $$F_p^*$$ gives sematic security, but not security against adaptive chosen ciphertext attatcks. Therefore, ElGamal encryption (as well as RSA encryption) must use a padding scheme in order to be secure against adaptive chosen ciphertext attacks. 85.2.11.148 21:18, 22 March 2007 (UTC)

 * OK yes, I see the argument that the group has to be of prime order. I still think it needs a citation, though. As an aside: any idea how serious a problem this actually is? Presumably it depends on how small is the largest prime you can expect to be a factor of p-1. As a further aside: would you suggest that this be reported as a bug to developers of implementations which use F_p^*? Mbays 16:53, 23 March 2007 (UTC)

 * My previous comment wasn't very clear. While ElGamal over appropriate prime order subgroups is semantically secure and ElGamal over $$F_p^*$$ is not we should not conclude that any ElGamal implementation using the group $$F_p^*$$ is immediately insecure and any system using a prime order subgroup is secure. It all depends on what padding scheme is used. For example, DHAES does not require groups for which the Decisional Diffie-Hellman assumption holds and still achieves security against chosen plaintext attacks. (Unfortunately, DHAES is not exactly ElGamal, just similar. But it should make the point clear. Anyway, I'll continue to look for a better example.) Also, I haven't found a reference for the sementically secure/not semantically secure comment above. It seems to be general knowledge, however. Who is using ElGamal encryption in their implementation? 85.2.99.179 18:57, 23 March 2007 (UTC)

 * Would Appendix A of that paper do as a reference for the statement? Mbays 20:16, 23 March 2007 (UTC)

 * Yes, indeed. I didn't notice the appendix. 85.2.57.232 00:54, 24 March 2007 (UTC)

 * OpenPGP is an implementation that uses $$F_p^*$$ for ElGamal to exchange key packages. These key packages are padded using PKCS #1 encryption padding. Since PKCS #1 encryption padding adds randomness this does take care of fact that ElGamal over $$F_p^*$$ is not semantically secure. Using a prime order subgroup would still be slightly nicer, because then one would have a proof that the scheme is sematically secure. But at least in the case of OpenPGP it is not wrong (or at least not immediatly obvious) to use $$F_p^*$$. (However, I'd prefer OAEP padding instead of PKCS #1 padding.) 85.2.121.89 12:52, 24 March 2007 (UTC)

 * A good citation for DDH holding in certain groups would be Dan Boneh's nice survey article. The second page has a quick list of groups believed to have the DDH property. The reduction from DDH to Elgamal's semantic security (CPA) is very common and very simple. An example proof can be seen here for instance (from a site I have quite an investment in, actually!). Blokhead 05:27, 24 March 2007 (UTC)

 * The link to the proof looks very useful. Boneh's paper is already referenced on the DDH page. 85.2.121.89 12:52, 24 March 2007 (UTC)

 * I was thinking of updating the section on the security, but there is still a reference missing. In particular, I'm looking for a reference that shows that assuming the computational Diffie-Hellman assumption for a group (or family of groups) implies that inverting ElGamal encryption is hard. This statement seems easy to prove. I.e., assume we are given an oracle that on input $$g, g^a, y=g^x, m g^{ax}$$ returns $$m$$ Then we can use this oracle to find $$g^{ab}$$ given $$g, g^a, g^b$$ as follows: Choose a random group element $$r$$ and call the oracle with $$g, g^a, g^b ,r$$. Assume it returns $$m'$$ as result. Then we can compute $$g^{ab}$$ from $$m' g^{ab}=r$$. The "Handbook of Applied Cryptography" probably refers to something similar when it states that ElGamal over $$F_p^*$$ is believed to be secure. Unfortunately, the book doesn't make a clear statement and doesn't give a reference. 85.2.110.35 07:20, 29 March 2007 (UTC)

Some significant changes
I decided to be bold and change things up a bit. I'm currently cleaning up all of the wikipedia articles that have to do with the decisional Diffie-Hellman assumption, as part of a grander masterplan. The biggest change here so far was to migrate all of the discussion about candidate DDH groups into the DDH article, since it was repeated in several other articles as well. I'm not sure whether it would be worth it to mention (in the Security section) that many implementations (and even textbooks) use $$\mathbb{Z}^*_p$$ as the underlying group, though DDH does not hold there. I'm inclined to mention it, though it might also come across as confrontational. Blokhead 04:23, 15 June 2007 (UTC)
 * I changed the security discussion, so that it more clear that DDH is not always required for the security of the scheme. 85.2.120.114 11:25, 15 June 2007 (UTC)
 * Thanks for pitching in. I don't know a lot about these different padding schemes, so I'll have to read up. Right now the only comment I have is that it is possibly confusing mentioning Cramer-Shoup amid those padding schemes. I will think about a better way to mention both alternatives (padding scheme; CCA schemes "based on" ElGamal).
 * As for the citation about one-wayness if CDH holds, I'll look around for one, but the proof is so simple probably no one has bothered putting it in a paper ;) Suppose ElGamal is not one way (I have an adversary that inverts random ElGamal encryptions with noticeable probability), then I will construct an algorithm for CDH (with the same noticeable success probability). I get $$(g^a, g^b)$$ as input, I pick a random $$z$$ from the group, and give the adversary $$g^a$$ as the public key, and $$(g^b, z)$$ as the ciphertext. It responds with some purported message $$m$$, and I output $$z/m$$ as my purported CDH answer. With noticeable probability, the adversary's response $$m$$ is the correct decryption of the ciphertext (i.e, it is such that $$z=mg^{ab}$$), so my CDH output is correct with the same probability. After this, I can use the random self-reduction of CDH/DDH to boost my CDH algorithm's correctness probability to very close to 1.
 * I don't think wikipedia is necessarily the best place for these kind of proofs. But maybe I can add it to the wiki site that includes the proof of CPA (that you just added the link to), if I can't find a reference elsewhere. Blokhead 13:59, 15 June 2007 (UTC)
 * I've looked for a reference for some time now without success. Putting a proof on a Cryptutor page seems reasonable to me. It might look easy, but there is still some formalism involved. 85.2.100.241 15:53, 15 June 2007 (UTC)
 * I looked at the DHAES paper, and I wouldn't consider it a "padding scheme", nor even claim that it's based on ElGamal. It is essentially a hybrid cryptosystem which uses Diffie-Hellman key exchange as the key encapsulation. ElGamal can be viewed as using DH key exchange as a key encapsulation for a one-time pad (both sender and receiver can compute $$g^{ab}$$ that they can use to mask/unmask the plaintext). But I don't think DHAES should be here in an article about ElGamal, as it doesn't really use ElGamal as a black-box. OAEP+ is fine, though we should probably re-iterate that it uses the random oracle model. Blokhead 15:32, 15 June 2007 (UTC)
 * Maybe Cramer-Shoup and DHAES could go int a section about related schemes. 85.2.100.241 15:53, 15 June 2007 (UTC)

Elgamal universal re-encryption
I saw an article talking about Elgamal re-encryption and Elgamal universal re-encryption, when I wanted to have more details, I did not found an article in wikipedia talking about that. Here's what is some contents of the article:

ElGamal re-encryption: Encryption(classical encryption) (c1,c2) = (m.yr,gr) ReRand: (c1,c2) = (c1.ys,c2.gs)

ElGamal universal re-encryption: Encryption (c1,c2,c3,c4) = (m.yr,gr,yt,gt) ReRand (c1,c2,c3,c4) = (c1.c3s1,c2.c4s1,c3s2,c4s2)

The aim is clear: the adversary may use the randomness used to secure semantically the encryption as a covert channel to transfer messages, though this method is not really sufficient to prevent these covert channels, because the adversary may use an unregistred key.

Key generation - error in article?
I am reading "Handbook of Applied Cryptography" (there is a free PDF online), which uses $$G = \Z_{p}^{*}$$ and states the the private key should be a random integer $$[1, p - 2]$$. The article claims it should be (after plugging in for $$q$$), $$[0, p - 2]$$. Furthermore, the book lists the same range, $$[1, p - 2]$$ for ElGamal signatures, but the article on that on Wikipedia lists $$[2, p - 2]$$. Basically:

I am also reading a research paper, "Breaking Smart Card Implementations of ElGamal Signature and Its Variants", listed as paper.

Also, the "generate a random number in *range*" bits differ. For example, in encryption, we are told to "choose a random $$y$$ from $${0, ... q - 1}$$, or, in the case of $$G = \Z_{p}^{*}$$, $$[0, p - 2]$$. Book differs.

To me it seems that encryption stuff is fragile as hell, and one mistake seems to bring the whole thing down, but here I've got three resources telling me different things. The differences don't stop at ranges - some want the random numbers to not divide $$p - 1$$, others want them to have a GCD of 1.

Chapter 8, page 294 of "Handbook of Applied Cryptography", and Chapter 11, page 454, same book for encryption and signature, respectfully.

Deathanatos (talk) 07:37, 20 September 2010 (UTC)

Flaws in article
This article tells you to use s^-1 to decrypt, but never says how to compute s^-1. Later it says to use s', which appears to be the same thing as s^-1...? And lastly an example would be extremely helpful for understanding. — Preceding unsigned comment added by Skintigh (talk • contribs) 15:38, 8 January 2012 (UTC)
 * The article describes ElGamal encryption generically, i.e., without specifying the group G. But the computation of s^-1 depends on which group is used to implement ElGamal encryption. E.g. if G is the multiplicative group modulo a prime p (or a subgroup of it), then s^-1 is a modular inverse, which typically is computed using the extended Euclidean algorithm. But if G is an elliptic curve group in Weierstrass form over a non-binary field then the inverse just requires to change the sign of a coordinate. s' is indeed the same as s^-1: the definition of s' just provides one possible way to compute this value.
 * Personally, I think that the article would be easier to understand if ElGamal were described using one specific group G only (e.g. a prime order subgroup of Z/(Zp)^*). Not sure what other people think. 188.60.32.125 (talk) 04:39, 9 January 2012 (UTC)
 * I included a note about it. Lucianobello (talk) 16:22, 19 November 2012 (UTC)

Is q a prime number?
There is currently an open question whether q must be prime. In the original paper by ElGamal the group G=Z/(p) (that is the group of residues modulo a prime p) is used and ElGamal proposes to use a primitive element as the generator. Such a generator has order q=p-1, which is of course divisible by 2. So far I'm not aware of a reason why ElGamal's choice does not work other than simplifying the analysis of a protocol. I.e., if one uses a subgroup of prime order then the DDH assumption may be applicable, which can simplify things. Depending on the protocol that uses ElGamal encryption DDH may be necessary, unecessary or may not be sufficient. Hence, results that can only be obtained by using a prime order group should be added (together with a reference) to the security section. However, we should not restrict the group order in the main section, unless there is a result showing that a group order that is not prime leads to attacks. 178.195.225.28 (talk) 16:49, 29 May 2012 (UTC)
 * To me, it seems that that whole section needs revising and clarifying. For example, shouldn't the h=g^x be done modulo p (as in the paper?). I can't see where the description of the group is. Handheldpenguin (talk) 17:37, 29 May 2012 (UTC)
 * Any group G for which the DH problem is infeasible may be used. This can be G=Z/(p), but it is also possible to use a group of points on an elliptic curve. The security section discusses some constraints on G. 178.195.225.28 (talk) 05:35, 30 May 2012 (UTC)

It should be pointed out that the above remarks about Z/(p) refer to the multiplicative group of units in Z/p (very proper notation would be $$(\mathbb{Z}/p\mathbb{Z})^\times$$), not the additive group (which is what one usually means by $$\mathbb{Z}_p$$, $$\mathbb{Z}/p$$, or $$\mathbb{Z}/p\mathbb{Z}$$).

There is generally a point in picking $$x$$ and $$y$$ as relatively prime to $$q$$, because if either is not then the shared secret ends up in a subgroup of $$G$$, thus shrinking the effective keyspace. Because an attacker who knows the factorisation of $$q$$ can cheaply determine the orders of $$h=g^x$$ and $$c_1=g^y$$ (there aren't that many possible values), this information leaks. However in the common case that $$q=2r$$ for $$r$$ a large prime, this subgroup is just as large ($$r$$ elements) as its complement, so committing to saying out of that subgroup also shrinks the keyspace by the same amount. In the $$q=2r$$ case the effect should thus only be that the keys have $$1$$ bit of entropy less than you'd expect. 130.243.94.123 (talk) 12:23, 15 June 2023 (UTC)

External links modified
Hello fellow Wikipedians,

I have just modified one external link on ElGamal encryption. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
 * Added archive https://web.archive.org/web/20090421130001/http://crypto.cs.uiuc.edu/wiki/index.php/Elgamal_encryption_scheme to http://crypto.cs.uiuc.edu/wiki/index.php/Elgamal_encryption_scheme

When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.

Cheers.— InternetArchiveBot  (Report bug) 15:36, 18 September 2017 (UTC)

Possible mistake in the calculation of the inverse of s
I think there is a mistake in the second proposed way of finding the inverse of s introduced by a recent edit (18:45, 30 November 2018). The article is written in a general setting of cyclic multiplicative groups and not in (Z/pZ)*, thus I couldn't find a source to cite. The exponent of c1 should be (q-x) and not (q-1-x) because the order of the group is q so g^q=e by Langrange's Theorem. The editor was possibly confused and thought that we are talking about (Z/qZ)* with q prime so by Fermat's Little theorem g^(q-1)=1. It's a very confusing mistake (if indeed it is), so I hope someone could please verify and edit. — Preceding unsigned comment added by Shadysin (talk • contribs) 14:02, 6 July 2019 (UTC)
 * I would just comment that if this is an error, it was not introduced by my recent changes. The 24 Feb 2019 version of the article had the same formulas, in the section Efficiency/Decryption and has remained unchanged for 10 years. It looks like it was originally added by an IP user on 9 May 2009: I think however that you are correct and the formula in the article has always been wrong. CodeTalker (talk) 15:23, 6 July 2019 (UTC)
 * Of course it was not introduced by your changes. And as you pointed out, indeed the "-1" was there 10 years ago. But at some point it was taken out (eg it's not there in ). I think it was reintroduced in November 2018 by an IP user . I believe it would be safe to edit the "-1" out since it seems that for the better part of the decade it was out (and some years before 2009 eg ) until some months ago.

 * That being said, we still don't have any references for this calculation, which is of course the source of the whole problem.Shadysin (talk) 10:50, 7 July 2019 (UTC)

 * I'm starting to think this article should be rewritten to assume the group G is just the multiplicative group of integers modulo n. The description of the system in Elgamal's original paper used integers modulo n rather than an abstract group as this article does. Most of Wikipedia's other cryptosystem articles that I've seen also use integers rather than abstract group members (RSA (cryptosystem), Rabin cryptosystem, Rabin signature algorithm, Digital Signature Algorithm, and even ElGamal signature scheme). I wonder why this one article was written this way; it seems to border on WP:OR. Rewriting it that way would give the article access to a lot more citable reference material, since AFAIK most of the relevant literature about ElGamal encryption is written using the concrete instantiation where the group members are integers modulo n and not the abstract notation used in this article. CodeTalker (talk) 21:43, 8 July 2019 (UTC)

 * I wholeheartedly agree, however this would be a big change and maybe more people should provide their opinion. The "Generalised ElGamal Encryption" could be kept in a final section (with some additions,eg that this formulation becomes useful for Elliptic Curve Cryptography), following closely the one reference we do have for it, namely the Handbook of Applied Cryptography, so as to avoid mistakes like the calculation of s^-1.Shadysin (talk) 17:01, 9 July 2019 (UTC)

More than just cyclic groups
This article could definitely be amended with other variants of ElGamal, such as over arbitrary finite abelian groups (as they are products of cyclic p-groups), over finite fields, and when considering elliptic curve groups over a finite fields (these are also abelian). Only mentioning cyclic groups seems reductive, and the article could definitely use some expansion given its importance. Callie Liddle (talk) 06:46, 7 October 2023 (UTC)

title: Talk:ElGamal encryption