I have some questions regarding aforementioned subject:
- Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
- Is ECIES-KEM sufficient ?
$\begingroup$
$\endgroup$
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
Short answer, - yes - yes To be honest I don't really know how to give a longer answer. He are some pointers http://www.secg.org/download/aid-780/sec1-v2.pdf http://digital.csic.es/bitstream/10261/32674/1/Gayoso_A%20Comparison%20of%20the%20Standardized%20Versions%20of%20ECIES.pdf
answered Apr 10, 2013 at 12:02
$\begingroup$
$\endgroup$
As I understand it, there's really no RSA equivalent in EC. See, for example, Why are elliptic curve variants of RSA "chiefly of academic interest"?
Shoup's Integrated Encryption Scheme (ECIES) is an entirely different cryptosystem, and its probably closer to Abdalla, Bellare and Rogaway's DHIES: An encryption scheme based on the Diffie-Hellman Problem in the integer world (sans the fact that ECIES is over EC).
$\begingroup$
$\endgroup$
The question is what you mean by "eqivalence".
RSA-OAEP yields to an RSA encryption scheme providing security against adaptive chosen message attacks (IND-CCA2) in the random oracle model, while plain RSA does not even provide IND-CPA security.
If you mean security (which I assume), then yes, ECIES also achieves the same formal security guarantees as RSA-OAEP in the elliptic curve setting.
If you want an encryption scheme for elliptic curves providing IND-CCA2 security without random oracles, i.e., relying only on standard assumptions, then you can take the elliptic curve version of Cramer-Shoup encryption.
Latter however, is less efficient then ECIES.
If you only require IND-CPA security, you can also use elliptic curve versions of ElGamal encryption.
Finally, while ECIES is a hybrid encryption scheme by design, the others aren't. However, you can turn them into hybrid schemes.