Let's say I want to use ECs to do asymmetric encryption. Suppose both sides have generated EC keypairs and have exchanged their public keys. I run ECDHE, and get a derived secret. I would then either use that as a key for AES, or create a derived key with an incrementing nonce for subsequent "sessions".

My gut tells me rolling my own is a bad idea. Not having seen this construct implemented in any crypto library tells me it's an even worse idea. Is there a concrete flaw in what I've described above?

  • $\begingroup$ Actually, a conceptually similar scheme is implemented for the secret box functionality of NaCl $\endgroup$ – SEJPM Nov 1 '17 at 22:48
  • $\begingroup$ You do not have forward security. Forward security has turned out to be important. $\endgroup$ – K.G. Nov 2 '17 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.