1
$\begingroup$

Do you know if ECIES encryption time is linear with the plaintext size, using the same key length?

$\endgroup$
1
  • $\begingroup$ How do you define linear time for encryption, key exchange? $\endgroup$
    – kelalaka
    Commented May 2 at 11:14

1 Answer 1

1
$\begingroup$

Yes, it usually is linear. This is simply because symmetric encryption is linear. Most ciphers or cipher modes have either no overhead or a small, static overhead for each message that is encrypted - for instance authentication tags for AEAD ciphers or padding for CBC mode. Otherwise such ciphers have as many ciphertext bytes as plaintext bytes.

The other variable size is the public component of the ephemeral key pair that is used to derive the symmetric key. However, that size depends only on the key size (for the specific parameters used) and it is not linked to the plaintext message size in any way.

However, usually the symmetric key is derived using some kind of Key Derivation Function or KDF. Such a function can take an "info" parameter for domain separation, which doesn't have a predefined size (for a specific ECIES scheme). Normally you'd expect it to have a specific value and thus size for a particular use case. However, in principle it can be set to (almost) any value so you might create a scheme that is not linear. I'd call that an academic possibility; it could be an issue if you want to create a proof, but that's about it.

In practice, for a specific key pair and use case you'd expect the message expansion to be linear.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.