I use an encryption scheme based on a symmetric cipher, with the corresponding symmetric key encrypted with RSA/OAEP using the public RSA key of the recipient. I now want to use ECC crypto in replacement of RSA. Looking at the openssl API I can see that there is no RSA equivalent ECC encryption of a key, but only key derivation. As the same symmetric key has to be encrypted for several different recipients, each of them owning its own encryption public ECC key, I can't directly use the derived key as the symmetric key.
So I am considering doing this:
- create a "one time" ECC key pair,
- derive a shared secret with this key and the recipient public key,
- xor the symmetric key with the derived shared secret, ensuring that the latter is at least as long as the symmetric key,
- sign the public part of the "one time" ECC key and transmit it along with the xor encrypted symmetric key so the recipient will be able to decrypt it.
I think that using xor encryption here is safe as:
- the derived shared secret is supposed to be random looking and will never be reused, as one of the keys used for derivation is a one time key,
- the derived shared secret is at least as long as the xor-ed content.
But maybe have I missed something?