make message $M$ also an element in q-order subgroup

[weikengchen]

Hi @RyanRiddle

This is the final solution I found to secure the message space.

By squaring the message $M->M^2$, it becomes an element in q-order subgroup. Interestingly, by powering $(q+1)//2$, we can get the unique square root. So decoding is easy.

This makes this library semantic secure.

Disadvantage: no compatible with old ciphertexts.

[RyanRiddle]

Hi @weikengchen

Thanks for the PR!

Can you explain in more detail why this works?

Thanks!

[weikengchen]

I am going to write a blog about this -- recently.

Thanks for patience!