Normally, when decrypting messages, you need to check if the message is authentic and integral (aka, never decrypt before checking the MAC).

With ECIES, this seems to be done internally. Is it necessary to include a MAC on your messages you encrypt when using ECIES?


From the original paper[1]:

DHIES is a Diffie-Hellman based scheme that combines a symmetric encryption method, a message authentication code, and a hash function, in addition to number-theoretic operations, in a way which is intended to provide security against chosen ciphertext attacks.

So the MAC is in this case already part of the scheme. If implemented correctly encryption should result in an ephemeral public key, a ciphertext, and a MAC / tag for the ciphertext being generated. So there's no need to generate another MAC.

[1] The distinction between DHIES and ECIES is simply the type of group being used for the underlying algebra, it isn't important in this context, much like the distinction between DH and ECDH


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.