I have one sender, and a small number (~5) of recipients. The sender knows each recipient's public EC key. I want the sender to broadcast a single message in such a way that any one of the recipients can decrypt it. For reasons that aren't completely technical, I'd like the security properties of the encryption algorithm to be as similar as possible to those of Bitmessage, which uses ECIES, with AES and HMACSHA256 as the symmetric cipher and MAC. I'd like the encrypted message to be as small as possible.
After a brief search, I couldn't find any "standard" (well-studied, or used somewhere high-profile) extension of ECIES for this case. I can obviously:
- Choose a random session symmetric encryption key and session MAC key.
- Symmetrically encrypt and MAC the message.
- Asymmetrically encrypt the session keys with ECIES, once per recipient.
Then I can broadcast a concatenation of the encrypted message and encrypted session keys, and any recipient can decrypt his copy of the session keys and decrypt the message. That adds a lot of overhead, though. So, using Wikipedia's variable names:
- When I do ECIES, can I omit the MAC $d$?
An attacker doesn't gain anything by tampering with the session key, since that just causes the inner decryption or MAC check to fail.The answer is "no" here if we naively encrypt-then-MAC the inner message, more complicated otherwise as discussed below.
- Can I use the same ephemeral EC pair $R = rG$ for all recipients?
- Can I use the same IV for all invocations of the symmetric cipher (once per recipient in ECIES, plus once for the message itself)?
- If the total length of my session keys is the same as the length of my $KDF()$ output, then can I get rid of the symmetric cipher $E(k_E;m)$ used within ECIES entirely, and replace it with $k_E \oplus m$? That would obviously render question 3 irrelevant.
I think the answer is "yes to all", but some of these look potentially subtle. Thanks!