Proving the CCA-insecurity of El Gamal encryption scheme I am trying to prove that El Gamal Encryption is not CCA-Secure.

If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\cdot 1)=(g^y,g^{xy}).$ Then he could calculate $g^{-xy}$. Then he sends the challenger a pair $(m_0,m_1)$. When he gets the challenge ciphertext $(c_1^*,c_2^*)$ he can decrypt it and finds out which message has been encrypted. Hence, the adversary wins the experiment with non-negligible probability.

Does this prove make sense, or did I miss something?

Thanks in advance.

Edit

This solution does not work since the value of y does not belong to the key, but it's generated randomly for every encryption.

A right solution would be as follows:

The adversary chooses some messages $m_0=x\ and\ m_1=y$. Then he sends these two messages $(m_0,m_1)$ to the challenger and get the encryption of one of them $&lt;c_1,c_2&gt;$. Then he picks some z and multiplies it with the  $c_2$ so he gets a new ciphertext $&lt;c_1, c_2 . z&gt; $. Then he queries the decryption oracle for the decryption of the new ciphertext. So, the resulting plaintext is either $x . z$ or $y . z$. Hence he can know which message has been encrypted.
No, as written, your technique doesn't work (as there's no specific reason why the encryption oracle use the same $y$ as the challenge ciphertext).

You need a different approach.  For one, the adversary doesn't need to depend on an encryption oracle; if he has the public key, then he can encrypt anything he wants.  What he does need to do is use the decryption oracle (as that performs an operation that the adversary cannot do himself).

So, how can the adversary create a ciphertext which is not the same as the challenge ciphertext, but when submitted to the decryption oracle, would tell him the answer?