# ECIES is must with Symmetric?(ECIES-AES or ECIES-TDES)

I can't understand the ECIES algorithm.

I saw two different ECIES algorithms:

1. Using only Public key

Key generation:

$A_{pri} : n_A$
$A_{pub} : n_A G$

$B_{pri} : n_B$
$B_{pub} : n_B G$

Encryption:

Select a random $k$.

A -> B to Cipher C : $\{kG, \text{message} + k B_{pub}\}$

Decryption

$\text{message} + k B_{pub} - n_B kG = message + k n_B G - n_B k G = \text{message}$

2. Using Symmetric key(AES)

what is real?

• The first one looks like ElGamal encryption and not like ECIES to me. Mar 23, 2016 at 12:59
• Do you have a source for the claim that the above algorithm is ECIES? Mar 23, 2016 at 13:04

## 1 Answer

Yes, ECIES is essentially a more practical implementation of ElGamal, a hybrid cryptosystem. It uses symmetric encryption following an ephemeral key exchange.

Compare it with : https://en.wikipedia.org/wiki/ElGamal_encryption

The only difference is that instead of using KDF+XOR or AES+GCM as the symmetric cipher, ElGamal specifies a different symmetric step mapping the message to a point and using inverse modulo to recover.

Once of the oddities is that using a KDF and then using XOR was the most popular version of ECIES for a number of years. If used carefully, it's OK, but without properly padding the message, things can get ugly (chosen ciphertext attacks, etc.)

Ditching XOR and using AES/GCM with the shared secret seems, to me, like the better move, shifting responsibility for the authentication onto the symmetric layer. The use of KDF/XOR is still prevalent in modern libraries, mostly because some XOR variants were FIPS certified.

• Please explain, or at least quote, the substantive parts of the links you cite. Links may change and don't help a reader on this site. Jul 17, 2018 at 21:51
• ECIES is not an instance of or implementation of Elgamal encryption. Elgamal encryption encrypts a point on the curve; ECIES encrypts a bit string under a symmetric-key cipher with a key derived from a public-key key agreement. They are not related except in that they use a group in which discrete logs are hard. Jul 17, 2018 at 21:53