I can't understand the ECIES algorithm.

I saw two different ECIES algorithms:

  1. Using only Public key

    Key generation:

    $A_{pri} : n_A$
    $A_{pub} : n_A G$

    $B_{pri} : n_B$
    $B_{pub} : n_B G$


    Select a random $k$.

    A -> B to Cipher C : $\{kG, \text{message} + k B_{pub}\}$


    $\text{message} + k B_{pub} - n_B kG = message + k n_B G - n_B k G = \text{message}$

  2. Using Symmetric key(AES)

what is real?

  • 3
    $\begingroup$ The first one looks like ElGamal encryption and not like ECIES to me. $\endgroup$ Commented Mar 23, 2016 at 12:59
  • 2
    $\begingroup$ Do you have a source for the claim that the above algorithm is ECIES? $\endgroup$ Commented Mar 23, 2016 at 13:04

1 Answer 1


Yes, ECIES is essentially a more practical implementation of ElGamal, a hybrid cryptosystem. It uses symmetric encryption following an ephemeral key exchange.

Refer to : https://en.wikipedia.org/wiki/Integrated_Encryption_Scheme

Compare it with : https://en.wikipedia.org/wiki/ElGamal_encryption

The only difference is that instead of using KDF+XOR or AES+GCM as the symmetric cipher, ElGamal specifies a different symmetric step mapping the message to a point and using inverse modulo to recover.

Once of the oddities is that using a KDF and then using XOR was the most popular version of ECIES for a number of years. If used carefully, it's OK, but without properly padding the message, things can get ugly (chosen ciphertext attacks, etc.)

Ditching XOR and using AES/GCM with the shared secret seems, to me, like the better move, shifting responsibility for the authentication onto the symmetric layer. The use of KDF/XOR is still prevalent in modern libraries, mostly because some XOR variants were FIPS certified.

  • $\begingroup$ Please explain, or at least quote, the substantive parts of the links you cite. Links may change and don't help a reader on this site. $\endgroup$ Commented Jul 17, 2018 at 21:51
  • 3
    $\begingroup$ ECIES is not an instance of or implementation of Elgamal encryption. Elgamal encryption encrypts a point on the curve; ECIES encrypts a bit string under a symmetric-key cipher with a key derived from a public-key key agreement. They are not related except in that they use a group in which discrete logs are hard. $\endgroup$ Commented Jul 17, 2018 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.