The Elliptic Curve Integrated Encryption Scheme (ECIES) describes how to derive a "temporal" key, encrypt a message (eg. using AES) and creating a MAC.

However, from my understanding using AES in GCM mode makes using an additional MAC obsolete. So, is it then safe to skip the MAC calculation step in ECIES when using AES-GCM?


It's perfectly safe; GCM provides both the confidentially and integrity guarantees that ECIES requires.

Just a few notes:

  • It doesn't matter what nonce you use; in fact, you can shrink the ciphertext a few bytes by making it implicit (as you'll use this GCM key only once)

  • The AAD information you give GCM can either be empty, or optionally include a shared secret ($S_2$ on the Wikipedia article)

  • $\begingroup$ Can you elaborate on why the nonce could be fixed, eg: all 1's? Is this because the ephemeral is never used twice? $\endgroup$ – Jonathan S. Fisher Mar 19 '18 at 19:36
  • 1
    $\begingroup$ @JonathanS.Fisher: it is precisely because you never use the same GCM key twice, which is true if you never use the same ECIES ephemeral twice. $\endgroup$ – poncho Mar 19 '18 at 19:42
  • $\begingroup$ @poncho If there is, could you give a quotable source? That would be very helpful. $\endgroup$ – jvdh Dec 10 '20 at 8:44
  • $\begingroup$ @jvdh: I'm not sure what source you want, but first, what are you asking about? That ECIES doesn't repeat keys if you don't reuse the same ephemeral? Or, if GCM is safe to use with fixed nonces if you never repeat keys? $\endgroup$ – poncho Dec 10 '20 at 13:13
  • $\begingroup$ That you don't need a MAC and KDF when using ECIES with AES in GCM mode $\endgroup$ – jvdh Dec 10 '20 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.