XOR instead of Multiplication in ElGamal encryption In the ElGamal encryption scheme, the message $m$ is multiplied with the secret $g^{xy}$ Wikipedia. I don't understand the advantage of it. Why we can't just XOR our message with the shared secret? As far as I know, multiplication is costlier than the XOR operation. Also, both the schemes will be CPA secure but not CCA secure, in that case, we have to add a MAC anyway. Can anyone please explain this to me?
One small question, from the DDH assumption we know $g^{xy}$ is random.


Actually, that's not true.  What the DDH assumption says is that we cannot distinguish $g^{xy}$ from $g^z$; however it does not say that we can't distinguish either from a random string.

Indeed, we can; if the order of $g$ has no small factors, then $g$ must be a quadratic residue (that is, there must exist a value $h$ with $h^2 = g$; this is easily tested); and hence $g^{xy}$ must also be a quadratic residue.  However, a random string is not a quadratic residue with probability 0.5, hence that serves as a distinguisher.

And, if $g$ is not a quadratic residue, then neither the DDH assumption nor indistinguishability from random hold, assuming the attacker can see $g^x$ and $g^y$; that's because $g^{xy}$ is a quadratic residue iff at least one of $g^x$, $g^y$ is a quadratic residue (hence the attacker can compute whether $g^{xy}$ is, even though he doesn't know the value).

This is why Yehuda is telling you to hash $g^{xy}$ first; $g^{xy}$ is distinguishable from a random string (although not necessarily due to a bias in any of the individual bits), $\text{hash}(g^{xy})$ is not.