Let p and q are primes such that p=2q+1. Let G={ aZ_q | aQR_p } (i.e G is a set of all quadratic residue modulo p).

Consider the variant of ELGamal encryption. Let g be a generator of G.

The private key is (G,g,q,x) and the public key is (G,g,q,h) where h=g^x (mod p) and x is chosen randomly from Z_q.

The plaintext space P=Z_q and the cipher text space is C={ (c_1,c_2 ) | c_1Z_q and c_2Z_q } to encrypt a plaintext mZ_q, choose uniformly rZ_q and compute c_1g^r (mod p) and c_2h^r+m (mod p) output the cipher text (c_1,c_2 ).

Is this scheme CPA-secure? Prove your answer using CPA Indistinguishability Experiment for public key encryption schemes