There's a lot of discussion and answers regarding RSA's limits when it comes to the size of the plaintext, but I couldn't find anything similar when talking about ECC.

Is there a limit? If so, why and what is it?


2 Answers 2


Is there a limit?

Depends on what ECC encryption algorithm you're talking about. ECC really means 'lets use elliptic curves to do cryptography', there are several ways to do that to do public key encryption.

If you use EC-ElGamal (which is just ElGamal translated to use Elliptic Curves), you're pretty much limited to the group size; you're encoding a EC point, and so you're limited to the number of EC points there are.

On the other hand, if you're using ECIES, there is no effective limit. That's because you're not really encrypting the message with the curve itself; instead, you're using ECC to transport a one-use symmetric key, and then using that symmetric key to encrypt the message (and so the only size limitation would be the limit of whatever the symmetric algorithm you're using has).

  • $\begingroup$ Constructing 1000+ bit curves is hard though isn't it? I believe it involves factoring large numbers. $\endgroup$
    – user10653
    Apr 21, 2017 at 5:56
  • $\begingroup$ Oh, so is ECIES what is used by NaCl's Box library? $\endgroup$
    – Awn
    Apr 21, 2017 at 6:42

I'd like to add what I have discovered with the Perl implementation of the ecc_encrypt() (Crypt::PK::ECC Module: <https://metacpan.org/pod/Crypt::PK::ECC>)

The encryption algorithm is using the hash output of a random number and XOR it with the plaintext, this means that the message length can not be longer than the hash output size.

  • 20Bytes for SHA1
  • 32Bytes for SHA256
  • etc.

The motivation behind is that one often encrypts symmetric keys so there is no need to go overboard with the length of the plaintext !

so here is my perl snippet:

use Crypt::Digest qw();
use Crypt::PK::ECC qw();
my $curve = 'secp256k1';
my $pub_raw = pack'H*','027e731260a2030bdb6ceb03539294cbd4b27c370e99062c1a1d889d3850d10a5d';
my $cleartext = '.'x128;
my $algo = 'SHA256';
my $size = Crypt::Digest->hashsize($algo);
my $pk = Crypt::PK::ECC->new();
my $pub = $pk->import_key_raw($pub_raw, $curve);
my $cipher = $pub->encrypt(substr($cleartext,0,$size), $algo);
printf "cipher: %s\n",unpack'H*',$cipher;

Hope that shines some light on some of the limitations of ECC libraries implementations.

  • $\begingroup$ Welcome to Cryptography.SE. I think you misread it this means that the message length can not be longer than the hash output size. this means you can't recover since hash functions are oneway! The link is contrary to what cryptographers advise, use hybrid Encryption like ECIES. One can easily convert the ElGamal encryption to a block cipher mode, just wondering how they solved the message-to-point encoding problem, though! $\endgroup$
    – kelalaka
    Oct 26, 2021 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.