Assumptions:
- $A$ wants to communicate with $B$
- $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$
- $A$ knows the address of someone who pretends to be $B$
$A$ wants to send a message to $B$ using ECIES:
- $A$ calculates a random private key $K$ and the related public key $P$
- $A$ calculates a shared secret $Z$ using $K$ and $P_B$ according to ECIES
- $A$ derives symmetric keys from the shared secret $k_1|k_2=\text{KDF}(Z_x)$
- $A$ encrypts a message $c=\text{ENCRYPT}_{k_1}(m)$
- $A$ tags the encrypted message $t=\text{MAC}_{k_2}(c)$
- $A$ sends $P|c|t$ to someone who pretends to be $B$
Questions:
- Can $A$ assume, that only $B$ can read the message? I think so.
- As $B$ does not know anything about $A$ what is the cryptographic purpose of the MAC? As $K$ and $P$ are message specific anyone who knows $P_B$ could have sent this message with a valid MAC to $B$!?
- Does removal of the MAC step reduce ECIES' security? I assume, but I don't get why.