An old exam question I am trying to figure out:

> 
> Consider the following protocol for two parties to flip a fair coin.
> 
> 
> * Trusted party **T** publishes her public key *pk*
> * **A** chooses a random bit $b\_A$, encrypts it under *pk*, and announces the
>  ciphertext $c\_A$ to **B** and **T**
> * **B** does the same and announces a ciphertext $c\_B$
> * **T** decrypts $c\_A$ and $c\_B$, and announces the results.
>  Both parties XOR the results to obtain the random value $b\_A \oplus b\_B$.
> 
> 
> (a) Argue that even if A is dishonest (but B is honest) the final
>  value of the coin is uniformly distributed.
> 
> 
> (b) Assuming that T uses ElGamal (where bit $b$ is encoded as $g^b$ before encryption),
>  show that a dishonest B can bias the coin to any value he likes.
> 
> 
> 

I can figure out a, but I am having trouble with b.