A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. I am therefore looking at ways to share a temporary symmetrical key decided by the client only.
Two solutions to that constraint seem to be :
- Generating an ephemeral key pair $(k,K)$, and encrypt the payload with $kP$ − ECDH.
- Generating a random key $r$ and encrypt it with EC ElGamal.
The ECDH approach requires 1 EC multiplication from the client ($kP$), 1 EC point to include in the datagram ($K$), and 1 EC multiplication from the server ($pK$).
According to the link above, the EC ElGamal approach seems to require 2 EC multiplications from the client, 2 EC points to include in the datagram, and 1 EC multiplication from the server.
Diffie-Hellman is apparently lighter in computation and header data. What is the advantage of using ElGamal ?