Most parts of public key cryptography has established standards which are in turn used in a large amount of real world applications. There is PKCS#1 for RSA based encryption and signatures and there is DSS for ECC based signatures.
But for some reason, I never came across a proper standardised form of a ECC based encryption scheme. Whenever I look at software trying to use, it usually is some homebrewed El-Gamal variant.
Am I missing something? Or is there a reason for that gap?
There is a scheme called the Elliptic Curve Integrated Encryption Scheme that has been "standardized". It is described in section 5.1 of SEC1v2. It is commonly used with EC to create an encryption scheme.
ECIES is a hybrid scheme that depends on a symmetric cipher (and a KDF and MAC algorithm) to encrypt the actual data. Generally that's fine as EC / ElGamal is very limited in what it can encrypt anyway. It is based on ephemeral-static DH, where the ephemeral private key is only used during encryption. You can see it as a delayed key agreement scheme, followed by data encryption.
There are a few problems that makes it trickier than just plain RSA encryption, disregarding the fact that most people find EC cryptography trickier anyway:
The problem that you have to specify the symmetric cipher yourself is why I put "standardized" between quotation marks: you cannot just say that it is ECIES encrypted and expect the other party to be able to decrypt. The configuration parameters for ECIES - and possibly the parameters of the configured algorithms - need to be described.
The benefit is that the ciphertext is generally somewhat smaller and that the decryption operation is more efficient. It is also much easier to have e.g. 256 bit security for the EC keys: just use 512 or 521 bit ECC key pairs (rather than > 16 Kib RSA keys). Besides that, RSA itself is also used in a hybrid scheme since messages are often larger than the modulus minus the required overhead for the padding (PKCS#1 v1.5 or OAEP padding).
