Modified ElGamal encryption (ElGamal encryption with messages in the exponent ) is implemented in a pairing friendly elliptic curve. Is it secure? In my scenario, I need to distinguish if the encrypted message is 0 or not. The message is encrypted by Elgamal encryption but with the message in the exponent. i.e. $(C,R)=(g^my^r,g^r)$ where $y$ is the public key. I wonder if my goal is just to distinguish if the plaintext is 0 or not, and the scheme is implemented in a paring friendly elliptic curve. In this case, I think I can use pairing to check if $e(C,g)=e(R,y)$, if the equation holds, then the plaintext is 0. A similar case, in helios voting protocol, the encrypted vote is either 0 or 1, if this voting scheme is implemented in a pairing friendly elliptic curve, I if it actually make the encryption non-sense?
Yes! Good observation! Although note that the original Helios paper by Ben Adida does not mention such implementation details, i.e., on which curve to instantiate the ElGamal encryption scheme.
Your observation basically stems from the fact that the decisonal Diffie-Hellman (DDH) assumption does not hold on pairing-friendly curves. On the other hand, one needs to assume the DDH assumption for the semantic security of the applied ElGamal encryption scheme. Therefore, the choice of the ElGamal encryption scheme implicitly implies that one needs to choose a suitable group, where the DDH assumption holds. If a pairing-friendly curve is chosen, then DDH does not hold, hence also the semantic security of the ElGamal encryption scheme is lost.