# ECIES with AES-GCM

The Elliptic Curve Integrated Encryption Scheme (ECIES) describes how to derive a "temporal" key, encrypt a message (eg. using AES) and creating a MAC.

However, from my understanding using AES in GCM mode makes using an additional MAC obsolete. So, is it then safe to skip the MAC calculation step in ECIES when using AES-GCM?

## 1 Answer

It's perfectly safe; GCM provides both the confidentially and integrity guarantees that ECIES requires.

Just a few notes:

• It doesn't matter what nonce you use; in fact, you can shrink the ciphertext a few bytes by making it implicit (as you'll use this GCM key only once)

• The AAD information you give GCM can either be empty, or optionally include a shared secret ($S_2$ on the Wikipedia article)

• Can you elaborate on why the nonce could be fixed, eg: all 1's? Is this because the ephemeral is never used twice? – Jonathan S. Fisher Mar 19 '18 at 19:36
• @JonathanS.Fisher: it is precisely because you never use the same GCM key twice, which is true if you never use the same ECIES ephemeral twice. – poncho Mar 19 '18 at 19:42