I have to make a choice based on the minimum stored data, so I would like to know which encryption protocol is better in terms of the size of the resulting ciphertext for very short plaintexts (8 to 40 bytes)? RSA? ElGamal? EICES?

  • $\begingroup$ RSA should generate 256 byte ciphertexts, ElGamal 512 byte and ECIES up to 88 bytes. $\endgroup$ – SEJPM Jul 3 '18 at 16:07
  • $\begingroup$ Can you provide a reference of these information? or how do you find these values? $\endgroup$ – SAliaMunch Jul 3 '18 at 21:14

A compressed point - which makes up the ephemeral public key for ECIES - only takes the key size, possibly prefixed by an indicator byte with value 02 or 03 (which is required by some libraries).

So for e.g. BrainpoolP256R1 you'd get 32 bytes, and maybe one more for the byte indicating that it is a compressed point. That is enough to derive a data encryption key. As the public point is already ephemeral there is no need for an IV. After key agreement you would just require the ciphertext bytes - which for CTR is identical to the plaintext message size.

So that would come down to a ciphertext size of 32 + 8..40, or 40 to 72 bytes (not including the indicator byte), while still giving you 128 bits of security (and no protection against quantum computers of sufficient size, of course). That's way less than the 256 bytes required for RSA, while RSA would be less secure on top.

  • 2
    $\begingroup$ Actually, for ECIES, you don't need the bit; you can do ECDH using only the x coordinates. $\endgroup$ – poncho Jul 3 '18 at 17:36
  • $\begingroup$ ... even more so when you use Curve25519 instead of bp256r1 $\endgroup$ – SEJPM Jul 3 '18 at 17:39
  • $\begingroup$ Adjusted for the indicator byte, with some clarification (sometimes using the normal procedure to load the public key should be preferred). Basically you can do with a single bit, and then use the other 7 bits for something else (multiple curve sizes, versioning etc.). $\endgroup$ – Maarten Bodewes Jul 3 '18 at 17:53
  • $\begingroup$ Also isn't your calculation for ecies missing the authentication tag? $\endgroup$ – SEJPM Jul 3 '18 at 21:16
  • $\begingroup$ @SEJPM Yesno. The minimum size for encryption is using CTR mode and the question reads stored data. For in place encryption that just requires confidentiality this is the minimum amount. For sending data or if integrity / authenticity is required then an authenticated mode such as EAX could be used with a 8 byte authentication tag (as using GCM mode with a shorter tag is not recommended). Good point though, other users may have different requirements. $\endgroup$ – Maarten Bodewes Jul 3 '18 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.