4
$\begingroup$

The Elliptic Curve Integrated Encryption Scheme (ECIES) describes how to derive a "temporal" key, encrypt a message (eg. using AES) and creating a MAC.

However, from my understanding using AES in GCM mode makes using an additional MAC obsolete. So, is it then safe to skip the MAC calculation step in ECIES when using AES-GCM?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

It's perfectly safe; GCM provides both the confidentially and integrity guarantees that ECIES requires.

Just a few notes:

  • It doesn't matter what nonce you use; in fact, you can shrink the ciphertext a few bytes by making it implicit (as you'll use this GCM key only once)

  • The AAD information you give GCM can either be empty, or optionally include a shared secret ($S_2$ on the Wikipedia article)

Improve this answer
$\endgroup$
6
  • $\begingroup$ Can you elaborate on why the nonce could be fixed, eg: all 1's? Is this because the ephemeral is never used twice? $\endgroup$
    – Jonathan S. Fisher
    Commented Mar 19, 2018 at 19:36
  • 1
    $\begingroup$ @JonathanS.Fisher: it is precisely because you never use the same GCM key twice, which is true if you never use the same ECIES ephemeral twice. $\endgroup$
    – poncho
    Commented Mar 19, 2018 at 19:42
  • $\begingroup$ @poncho If there is, could you give a quotable source? That would be very helpful. $\endgroup$
    – jvdh
    Commented Dec 10, 2020 at 8:44
  • $\begingroup$ @jvdh: I'm not sure what source you want, but first, what are you asking about? That ECIES doesn't repeat keys if you don't reuse the same ephemeral? Or, if GCM is safe to use with fixed nonces if you never repeat keys? $\endgroup$
    – poncho
    Commented Dec 10, 2020 at 13:13
  • $\begingroup$ That you don't need a MAC and KDF when using ECIES with AES in GCM mode $\endgroup$
    – jvdh
    Commented Dec 10, 2020 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.