Some Facts
Doing it in Java
So what? There is PGP
So how can I use the Emacs Lisp version
References

The Cramer Shoup Crypto System

* Toy implementations in Emacs Lisp and Java *

Some Facts

This crypto system was published in the Crypto'98 [CS98]. I am not aware of any industrial sized implementation to this point, though IBM is said to attempt this. You might like to visit the home pages of it's designers Ronald Cramer and Victor Shoup in order to get some recent information. Further references are found here.
The security relies on the discrete log problem, i.e. given a (large) prime p, a generator g of Z_p^* and a number a, find the (unique in 1..p-1) number x such that g^x == a (mod p). This problem is believed to be at least as difficult as factoring, though there are some special cases known where it is easy (e.g. if p is of the form 2^k+1, we refer to [L87]).
It is a public key encryption - i.e. every key is a pair (pk,sk) where pk is the public key and sk is the secret key. Encryption uses pk, while Decryption is generally believed to be computationally intractable without specific knowledge of sk. The public key can be made available e.g on the personal Internet home page. Thus 'everyone' can send a encrypted message to you, but you are the only one who can decrypt it.
The algorithm can be applied on 'arbitrary' key sizes, i.e. every user can decide which bit-length k his key should have (less then 1000 is usually considered insecure).
Encryption is 'probabilistic' - i.e. if the same text is encrypted twice, the ciphertext usually will be different. They also will be longer (in the size of bits) by a factor of four, in order to guarantee decryption to the original message.
One amazing feature of this system is that it comes with a proof of security against adaptive chosen ciphertext attacks. I.e if your hardware device (say your workstation) can be used by an adversary for a limited time (e.g. while you are at lunch) to decrypt chosen ciphertexts without actually 'stealing' the secret key, it does not help him too much to decrypt any ciphertexts except the ones he decrypted explicitly. Thus, by simply keeping a local list of cipher texts that you prevent from being decrypted straightforward (i.e. those you generated), you can---at least in theory---add some security.

Doing it in Java: some recent news

I implemented the crypto algorithm in Java and added a applet wrapper, so you can access it with ASCII text. Have a look at the sources.
It's now possible to create your own keys!
Experiment with a Toy Key pair put in an applet
Send me an encrypted mail message, using the Java Virtual Machine in your web browser and my public key.
Think it can be broken?
Decrypt this and earn easy 1000,- DKK

This toy implementation is by no means a competition to PGP, no matter which version. But this is due to the fact that it is so slow, not that it is so bad. Actually it has some advantages over PGP - namely that it is small. Allow me to explain why this is an advantage:

When you install PGP (e.g. 5.0) there is a huge rat tail of small utilities and programs you install as well. You cannot possibly know what they are doing. You cannot know if they do what they claim to do. In theory, you could check this --- it's open source --- but this would take weeks. Thus usually you rely on the guys who program it and - perhaps better - the wide community who uses it. If there are bugs (or even worse: if it is inherently insecure to some implementation detail) hopefully somebody else finds out about it (and warns everybody), before you suffer any damage yourself.
It is a nice thought that with this Cramer Shoup toy implementation you have a encryption system that is actually small enough that you can look through it and understand everything it does (in first place, this is why I wrote this toy implementation). The paper describing the design is just 12 pages and very well written. The implementation is fairly readable lisp. You are free (and most welcome) to check everything.

So how can I use the Emacs Lisp version ?

The Emacs Lisp version is actually the older implementation of the algorithm. You need emacs or xemacs with some primitive emacs-lisp version. Download the following text file to some directory your editor can find it ($HOME/emacs/ would probably be a good choice).
cs-crypt.el
Then do the following:

Open your $HOME/.emacs file and add this line:
```
 (setq load-path (cons (concat (getenv "HOME") "/emacs") load-path))
```
This will make the directory $HOME/emacs visible to emacs. Maybe it already is; then you can omit this step (it does not hurt, if you do it in any case).
Open some emacs editor. Open the file $HOME/emacs/cs-crypt.el you just downloaded. Then type

M-x eval-buffer [RETURN] M-x emacs-lisp-byte-compile-and-load [RETURN]

This compiles the emacs lisp file and creates the file cs-crypt.elc in $HOME/emacs. If you are using the pseudo-random generator, you will be asked to enter some 'random' string in order to initialize it. If you just want to 'play', you can ignore this.
If you want, you can now add the line
(require 'cs-crypt)
to your .emacs file, in order to load this library automatically.
Encryption:
Open a emacs buffer <FILENAME> with the text you'd like to encrypt. Then type

M-x cs-encrypt-buffer

This will (after some time) create a new buffer called <FILENAME>.cse containing a base64 encoding of your crypto-text. It is ready to be sent by email.
Of course, you should ask were you determine your recipient(!) - it is via the global variable *cs-recipient*. In the beginning it is set to some dummy name, just to let you test the toy. If you really want to use it, you should add some public keys to the variable *cs-list-of-public-keys* and recompile cs-crypt.el as described above. Afterwards it is sufficient to change the variable *recipient* during a emacs session, e.g. by

M-x set-variable [RETURN] *recipient* [RETURN] [actual recipient] [RETURN]
Decryption:
You can only decrypt messages encrypted with your public key. Your secret key must be stored in cs-crypt.el as the constant *cs-personal-secret-key*. To decrypt, just open a buffer [CRYPTO-FILE] containing the base64-encoding of the crypto-text addressed to you. Type

M-x cs-encrypt-buffer

This will create a new buffer named [CRYPT-FILE].csd you can readily read or safe.
If you'd like to encrypt not text, but arbitrary files, this is not a problem (in principle). You can proceed just as described above; However you should set the variable *pedantic-surplus-remove* to T in order to make sure that surplus zero-bits at the end are cut off. NOTE: if you make copies of cs-crypt.el to your friends, take good care to remove your personal secret key first.
For details how to create your key-pair, compute new prime moduli etc, please consult the cs-crypt.el file.

So happy en- and decryption, and if you'd like to send me your comments, just do so.

References

[L87] Lüneburg, Heinz: On the rational normal form of endomorphisms. A primer to constructive algebra. Mannheim/Wien/Zuerich: B.I.-Wissenschaftsverlag. 397, 1987
[CS98] Ronald Cramer and Victor Shoup: A practical public key crypto system provably secure against adaptive chosen ciphertext attack. in proceedings of Crypto 1998, LNCS 1462, p.13ff