I am confused about the distinction between RSA and ECC (Elliptic curve) regarding encryption and would appreciate it if someone could confirm whether my understanding is correct.
To encrypt a large file using RSA:
- Generate a random symmetric key
- Encrypt the file using the symmetric key (AES, for example)
- Then encrypt the symmetric key using the receiver's public key
- Send the encrypted file + encrypted symmetric key
- The receiver takes the encrypted symmetric key and decrypts it using his private key
- Then the receiver decrypts the file using the decrypted symmetric key
But if I understand correctly, encrypting using ECC is completely different, especially the order:
- Instead of generating a random symmetric key, "derive" it using ECDH (using sender's private key and receiver's public key)
- Then encrypt the file using the derived symmetric key (AES)
- Hand this over to the receiver
- The receiver derives the same shared key using ECDH (same logic as step 1)
- The receiver decrypts the decrypted file using AES
There is no such thing as "asymmetric encryption" in ECIES. There is only symmetric encryption using AES, but it works like asymmetric encryption because the shared key is generated using asymmetric cryptography.
Questions
1. Is this correct?
Do I understand this correctly? Is there no way to create a "single encrypted file" that gets shared with everyone (instead, you have to generate a distinct encrypted file for each receiver)
2. Higher guarantee that only the receiver can open it?
Suppose you're effectively generating a different version for each user. Does this mean ECIES (while it's more wasteful in terms of data generated and stored) has a higher guarantee of ONLY the receiver being able to open the message? Because in the case of RSA + AES, there's only one encrypted file. If the session key gets leaked, anyone can decrypt it, whereas in ECIES, if a receiver wants to leak a message, he needs to leak his private key. Is this correct?
3. How to efficiently broadcast to multiple parties?
If this is the case, how would I implement 1-to-N broadcast encryption of a single message efficiently?
For example, let's say I want to send a single 1GB file to 1000 people. Everybody gets the same file.
- RSA+AES: Using RSA + AES, I can encrypt the file once and only generate N different encrypted keys. Let's say the encrypted file is 2GB and each encrypted key is 1KB. This means I end up with 2GB + 1000*1KB of data to transmit.
- ECIES: But when using ECIES, I must generate N unique encrypted files, which means 2GB * 1000 = 2TB of data to transmit.
If my understanding is correct, this ECIES approach does not scale as well as RSA+AES. Have I misunderstood anything? How would one implement a broadcast of encrypted messaging for ECIES?