In the ECIES scheme, the sender generates an ephemeral public key per each message it encrypts. This public key, together with the receiver's private key, is used in order to generate a shared secret that is input to a KDF function that outputs both the encryption symmetric key and the MAC key. However, if instead of the real intended sender, an opponent is impersonating to be the real sender, and sends its own ephemeral public key, the scheme cannot detect it. So how should this used in practice, does the standard supports some sort of digital signature for the public key? If so, this digital signature must be calculated again per each message, as the public key is re-generated each message. So how this is done in practice? And, finally, if digital signature is added anyway, then it can be added for the whole message, thus seemingly saving the MAC calculation step.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.