Wouldn't encrypting a message with AES, then encrypting the (randomly generated) AES key and IV with the EC public key suffice?
What attack vectors does ECIES protect against, that an AES-then-EC-encrypt wouldn't?
$\begingroup$
$\endgroup$
4
-
2$\begingroup$ How would you convert the AES key to a curve point? $\endgroup$– SEJPMSep 10, 2015 at 19:23
-
1$\begingroup$ Which EC-encrypt would that be? That's kind of the point. Besides, ECIES is pretty much ephemeral-static DH. If you already have ECDH then it's not that complex. $\endgroup$– Maarten Bodewes ♦Sep 10, 2015 at 20:15
-
$\begingroup$ Your suggestion sounds more complex than ECIES to me. $\endgroup$– CodesInChaosSep 10, 2015 at 20:43
-
$\begingroup$ @MaartenBodewes Your (and SEJPM's) questions explain it all - I forgot that there is no EC-encrypt analogous to the limited-length-plaintext encryption you can do with RSA. $\endgroup$– fadedbeeSep 11, 2015 at 9:56
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
Wouldn't encrypting a message with AES, then encrypting the (randomly generated) AES key and IV with the EC public key suffice?
Yes it would suffice and is what is usually done. However for this to work you'd have to have a way to reliably convert a random integer to a curve point and back which isn't trivially possible. And even if you could reliably encode the key to be a curve point you may be vulnerable to some attacks using collision properties resulting in a much smaller security margin than expected, much like encrypting "small" values with RSA.
This is why ECIES randomly chooses a curve point, encrypts this one and uses the secret point to derive keys.
What attack vectors does ECIES protect against, that an AES-then-EC-encrypt wouldn't?
ECIES provides chosen ciphertext security meaning it provides security against most known attacks. Simple AES-then-EC-encrypt may not be secure against such attacks if you don't do authentication of the plaintext. If you'd use something like AES-GCM with the above mechanism to encapsulate the keys you're pretty much at ECIES although ECIES uses its KDF to derive the keystream and uses HMAC to authenticate the ciphertext.
$\begingroup$
$\endgroup$
ECIES may seem complex, but if you try another approach, you would end up with something very much like it.
If you only encrypt with AES, then you are not authenticating, which is most cases you also need to do. If you then encrypt and authenticate by yourself, you pretty much reinvented ECIES.
But yes, ECIES is in higher layer of abstraction compared to simple RSA encryption, for example.
