Can I apply "encrypt with public key and decrypt with private key concept" using ECC certificate?

Question

If Alice wants to send encrypted message to Bob, she can use Bob's public key to encrypt the plain message. Once Bob reliably gets encrypted message, he can decrypt it with his private key. In this process, Bob will never have to know anything about Alice (assuming message is not tampered). In other words, Alice does not need her own public/private key pair. Further this process can be easily achieved by Bob's RSA certificate and Alice does not have to have any RSA certificate. I also understand that this is following asymmetric algorithm (i.e. using PKI).

How does this encryption and decryption process change if Bob has ECC certificate only?

I have reviewed Integrated Encryption Scheme (https://en.wikipedia.org/wiki/Integrated_Encryption_Scheme). As far as I can tell, both DLIES and ECIES seem to suggest deriving a key (using key agreement protocol), then encrypt and decrypt messages using that key, which is essentially a symmetric algorithm.

1. Does not this mean both Alice and Bob need each other's ECC public key?

2. If so, this process appears to differ when RSA certificate is used. Am I correct?

3. Does this mean Alice now needs her own ECC certificate because she needs to send her public key to Bob along with encrypted message so that Bob can successfully decrypt it using Alice's public key and his private key?

Answer 1

You are right that (EC)IES essentially consists of a Diffie-Hellman key agreement and authenticated symmetric encryption, but the protocol flow is different. In particular, IES is a "one-shot" public-key encryption scheme: Assuming that Alice knows Bob's public key beforehand, she can encrypt a message for Bob "offline" without any interaction, just like with RSA.

In summary, ECIES consists of the following steps:

1. Assume Alice knows Bob's public key $Y=[y]P$.
2. Alice generates a random private key $x$ and computes $[x]Y$.
3. She derives a symmetric key $k$ from $[x]Y$.
4. Using some authenticated symmetric encryption algorithm, she encrypts her message using $k$ as the key, yielding a ciphertext $c$.
5. She transmits the pair $([x]P,c)$ to Bob.

Based on this, we can answer your questions:

1. No, in IES the receiver (Bob) does not need Alice's long-term public key because she generates a fresh ephemeral key pair (whose public part is transmitted as part of the ciphertext) for each message. In fact, Alice does not even need to have a long-term key to be able to encrypt messages for Bob! This is in line with the general public key encryption setting: Everybody can encrypt, only Bob can decrypt.

2.: Yes, the encryption procedure for RSA is different from IES. But the protocol flow is not! Both are public-key encryption schemes.

3. No, according to 1.