2
$\begingroup$

Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ciphertexts already have to be split up into multiple blocks so that no one block exceeds the size of the modulus.

$\endgroup$
2
$\begingroup$

Yes, it can make some sense, and I've seen it in practical use. But beware that you can only encrypt very small plaintext and that's only after you make adjustments to the MGF-1 scheme to use a smaller hash (the leftmost bits of an existing hash, for instance).

For a generic cryptosystem you could use a large (512 bit) curve and use hybrid cryptography to get around the small payload size. But for a generic cryptosystem you are much better off using ECIES to accomplish the same thing.

I would only use El Gamal / OAEP if the ElGamal encryption has specific properties that you want to use.

$\endgroup$
  • $\begingroup$ The problem that I'm having with ECIES is a very long time taken to perform the KDF on the point returned by ECIES. I would like said KDF to be faster, but the minimum reccomendation I heard for PBKDF2 was 100,000 iterations of SHA-256. Is there some still secure way to derive a key from the point without taking so long? $\endgroup$ – ThePlasmaRailgun Oct 11 '18 at 18:48
  • 3
    $\begingroup$ PBKDF(2) is a password based key derivation function. However, your input is not a password, and you don't need the password stretching. (EC)DH should already return a shared secret with a lot of entropy. So you can either use a Key Based Key Derivation Function (KBKDF) such as HKDF or you could simply use PBKDF2 with an iteration count of 1 if no KBKDF is available. Using a hash of HMAC can be seen as a poor man's KBKDF, by the way. The recommendation you mention is for passwords only (and it should not be a static value). $\endgroup$ – Maarten Bodewes Oct 11 '18 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.