2
$\begingroup$

The Elliptic Curve Integrated Encryption Scheme (ECIES) describes how to derive a "temporal" key, encrypt a message (eg. using AES) and creating a MAC.

However, from my understanding using AES in GCM mode makes using an additional MAC obsolete. So, is it then safe to skip the MAC calculation step in ECIES when using AES-GCM?

$\endgroup$
2
$\begingroup$

It's perfectly safe; GCM provides both the confidentially and integrity guarantees that ECIES requires.

Just a few notes:

  • It doesn't matter what nonce you use; in fact, you can shrink the ciphertext a few bytes by making it implicit (as you'll use this GCM key only once)

  • The AAD information you give GCM can either be empty, or optionally include a shared secret ($S_2$ on the Wikipedia article)

$\endgroup$
  • $\begingroup$ Can you elaborate on why the nonce could be fixed, eg: all 1's? Is this because the ephemeral is never used twice? $\endgroup$ – Jonathan S. Fisher Mar 19 '18 at 19:36
  • 1
    $\begingroup$ @JonathanS.Fisher: it is precisely because you never use the same GCM key twice, which is true if you never use the same ECIES ephemeral twice. $\endgroup$ – poncho Mar 19 '18 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.