Check if this cryptosystem is safe Let $G$ be any group where group operations, as well as finding the inverse of an
element, can be performed quickly, but the discrete log problem is difficult. Consider
the following cryptosystem:


Alice chooses an element $g ∈ G$, a message $m ∈ G$, and an integer $k_A$.
Alice computes $s = mg^{k_A}$ and sends $s$ to Bob.
Bob chooses an integer $k_B$, computes $t = sg^{k_B}$ , and sends Alice $t$.
Alice computes $u = tg^{−k_A} = mg^{k_B}$ and sends $u$ to Bob.
Bob computes $ug^{−k_B} = m$ and recovers the message.


Is this cryptosystem safe?
I've noticed that Eve has $s$, $t$, and $u$ 
and that they are all divisible by m. Does this mean it's not safe? Or what am I missing?

Help is appreciated
This is extremely insecure. The discrete log is a red herring -- nowhere in the problem is the difficulty of discrete log relevant, because neither party ever uses their knowledge of their private exponent (computing $g^{-k}$ given $g^{k}$ does not require knowledge of $k$, so if inverses are fast to find, knowing one gives you the other quickly). That means we can ignore the exponentiation; all you have is Alice picking $a\in G$ and Bob picking $b\in G$, so $s=ma$, then $t=mab=sb$, then $u=ta^{-1}=mb$. Eve intercepts $s,t,u$, and computes $s^{-1}$, then $s^{-1}t=b$, then $b^{-1}$, then $ub^{-1}=m$. The issue isn't really that they're all divisible by $m$, it's that you rely on keeping $a$ and $b$ private but then send $s$ and $sb$ over a public channel (which means an attacker can easily recover $b$ and thus $m$).

In actual ElGamal, you actually use your private exponent. Instead of having to keep $g^{k_A}$ and $g^{k_B}$ secret, you rely on the fact that Alice (who knows $g^{k_B}$ and $k_A$) can compute $g^{k_Ak_B}$ while an attacker cannot. To use the security of discrete log, you have to do something that's easy for someone knowing the exponent but difficult for someone else; finding the inverse is not that something.