I am confused about the distinction between RSA and ECC (Elliptic curve) when it comes to encryption and would appreciate it if someone could confirm if my understanding is correct.
When encrypting a large file using RSA, you:
- Generate a random symmetric key
- Encrypt the file using the symmetric key (AES for example)
- Then you encrypt the symmetric key using the receiver's public key
- You send the encrypted file + encrypted symmetric key
- The receiver takes the encrypted symmetric key and decrypts it using his own private key
- Then the receiver decrypts the file using the decrypted symmetric key
But if I understand correctly, encrypting using ECC is completely different, especially the order:
- Instead of generating a random symmetric key, you "derive" it using ECDH (using sender's private key and receiver's public key)
- Then you encrypt the file using the derived symmetric key (AES)
- You hand this over to the receiver
- The receiver derives the same shared key using ECDH (same logic as step 1)
- The receiver decrypts the decrypted file using AES
Basically, there is no such thing as "asymmetric encryption" in ECIES. There is only symmetric encryption using AES, but it works like asymmetric encryption because the shared key is generated using asymmetric cryptography.
Questions
1. Is this correct?
Am I understanding this correctly? Is there no way to create a "single encrypted file" that gets shared with everyone (instead you have to generate a distinct encrypted file for each receiver)
2. Higher guarantee that only the receiver can open?
If you're effectively generating a different version for each user, does this mean ECIES (while it's more wasteful in terms of data generated and stored) has a higher guarantee of ONLY the receiver being able to open the message? Because in the case of RSA + AES there's only one encrypted file, if the session key gets leaked anyone can decrypt it, whereas in ECIES if a receiver wants to leak a message, he needs to leak his private key. Is this correct?
3. How to efficiently broadcast to multiple parties?
If this is the case, how would I implement 1-to-N broadcast encryption of a single message efficiently?
For example, let's say I want to send a single 1GB file to 1000 people. Everybody gets the same file.
- RSA+AES: Using RSA + AES I can encrypt the file once and only generate N different encrypted keys. Let's say the encrypted file is 2GB and each encrypted key is 1KB. This means I end up with 2GB + 1000*1KB of data to transmit.
- ECIES: But when using ECIES, I must generate N unique encrypted files, which means 2GB * 1000 = 2TB of data to transmit.
If my understanding is correct, this ECIES approach does not scale as well as RSA+AES. Am I misunderstanding something? How would one implement a broadcast encrypted messaging for ECIES?