Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have some questions regarding aforementioned subject:

  • Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
  • Is ECIES-KEM sufficient ?
share|improve this question

3 Answers 3

up vote 1 down vote accepted

Short answer, - yes - yes To be honest I don't really know how to give a longer answer. He are some pointers http://www.secg.org/download/aid-780/sec1-v2.pdf http://digital.csic.es/bitstream/10261/32674/1/Gayoso_A%20Comparison%20of%20the%20Standardized%20Versions%20of%20ECIES.pdf

share|improve this answer

As I understand it, there's really no RSA equivalent in EC. See, for example, Why are elliptic curve variants of RSA "chiefly of academic interest"?

Shoup's Integrated Encryption Scheme (ECIES) is an entirely different cryptosystem, and its probably closer to Abdalla, Bellare and Rogaway's DHIES: An encryption scheme based on the Diffie-Hellman Problem in the integer world (sans the fact that ECIES is over EC).

share|improve this answer

The question is what you mean by "eqivalence".

RSA-OAEP yields to an RSA encryption scheme providing security against adaptive chosen message attacks (IND-CCA2) in the random oracle model, while plain RSA does not even provide IND-CPA security.

If you mean security (which I assume), then yes, ECIES also achieves the same formal security guarantees as RSA-OAEP in the elliptic curve setting.

If you want an encryption scheme for elliptic curves providing IND-CCA2 security without random oracles, i.e., relying only on standard assumptions, then you can take the elliptic curve version of Cramer-Shoup encryption.

Latter however, is less efficient then ECIES.

If you only require IND-CPA security, you can also use elliptic curve versions of ElGamal encryption.

Finally, while ECIES is a hybrid encryption scheme by design, the others aren't. However, you can turn them into hybrid schemes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.