I'm studying the Integrated Encryption Scheme and I did't understand which are the main differences between ECIES and DHIES. Can someone help me ?
Thank you in advance.
$\begingroup$
$\endgroup$
2
-
1$\begingroup$ Are you asking for differences beyond the group being used? $\endgroup$– SEJPMCommented Jul 5, 2018 at 9:50
-
$\begingroup$ Yes, because a part from the group used I didn't found any differences in the scheme $\endgroup$– thinker.92Commented Jul 5, 2018 at 10:13
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
ECIES is DHIES restricted to an Elliptic Curve group, when DHIES is defined for any cyclic group, including but not limited to $\Bbb Z_p^*$.
Mihir Bellare writes on his web page on DHIES: An encryption scheme based on the Diffie-Hellman Problem that it
describes a Diffie-Hellman based encryption scheme, DHIES, (formerly named DHES and DHAES)..
The SEC1: Elliptic Curve Cryptography, v1.0 standard by SECG includes DHIES
and SEC 1: Elliptic Curve Cryptography Ver. 1.0 (dated September 20, 2000) mentions ECIES stating that "It was proposed" in that article, referenced under the old name DHAES. SEC 1 Ver. 2.0 references that article under the new name DHIES. Both versions of SEC1 are elliptic about the origin of the name ECIES.
Update: I read in Victor Shoup's A Proposal for an ISO Standard for Public Key Encryption (version 2.1 dated December 20, 2001) that there was ECIES as proposed in P1363a (as drafted July 21, 2001), and ECIES-KEM, with only the later secure against adaptive chosen ciphertext attack (thru some compatible restriction).
The P1363a rationale (as drafted July 16, 2003 shortly before adoption) clarifies:
C.3.5 For the DL and EC families, why was the DL/ECIES encryption scheme selected?
Several proposals on DL and EC encryption schemes were presented to the P1363 working group during the development of IEEE Std 1363-2000. None of the proposals was considered mature enough to include in IEEE Std 1363-2000 and it was expected that a suitable encryption scheme would be established during the P1363a effort. The DL/ECIES scheme has emerged as a common reference in several other standards efforts, including ANSI X9.63 [B12] and SEC-1 [SEC-1], with accompanying security analysis, and is thus considered appropriate for the amendment. DL/ECIES has two modes: non-DHAES mode, which is compatible with ANSI X9.63 and SEC-1 but does not have the full set of security properties of the DHAES scheme on which it is based (see Abdalla, Bellare, and Rogaway [ABR98]); and DHAES mode, which has the full set. (..)
In the end my reading is that draft DH(A)ES is history, DHIES never had issues, and ECIES is its restriction to an Elliptic Curve group.
