When creating ElGamal keys, the generator wasn't a square residue: ElGamal encryption done with those keys cannot be secure under the DDH assumption - https://bugzilla.redhat.com/show_bug.cgi?id=1542313 (CVE-2018-6594) - https://github.com/TElgamal/attack-on-pycrypto-elgamal - https://github.com/Legrandin/pycryptodome/issues/90 - https://github.com/dlitz/pycrypto/issues/253 - https://github.com/dlitz/pycrypto/pull/256
Paul Howarth