EC Public key encryption scheme where Alice does not know Bob's public key

Question

I've found ECDH and ECIES, but those both require Alice to know Bob's public key and Bob to know Alice's public key in order to derive a shared secret. Now assume Bob knows Alice's public key $A$, but Alice does not know Bob's public key $B$. Is there an Elliptic Curve encryption scheme where Bob can encrypt a message for Alice using just their public key $A$ which Alice can then decrypt without needing Bob's public key? (The reverse is not necessary, Alice does not need to send any encrypted messages to Bob)

Answer 1

ECIES does not require the sender to publish their own permanent public key. Instead, they can just create an anonymous ephemeral key pair, and publish the ephemeral public key along with the ciphertext. The sender can discard the ephemeral private key as soon as the encryption has been completed. Alternatively, the private key can be retained so that the sender can provide a signature at a later time to prove that they were the sender.

Answer 2

You might be looking for anonymous messaging in which the sender hides their identity from the receiver. The Libsodium has one specially designed for this sealed_box

Only the recipient can decrypt these messages, using its private key. While the recipient can verify the integrity of the message, it cannot verify the identity of the sender.

Bob can decrypt the incoming message from Alice, however, they cannot verify the identity of the sender. Also, there is no way Eve can determine the sender, too. This scheme uses an ephemeral private and public key pair (generated and used once) is generated and later the ephemeral private key is destroyed. As long as the sender IP etc. is hidden from the observers, there is no way to determine the sender.

Note 1: this is an existing and well-maintained library that you don't need to implement anything to achieve your target.

Note 2: ElGamal Encryption (1985) , on the other hand, is exactly designed in this manner. Alice doesn't need to set up a public-private key pair to send a message to Bob. ElGamal Encryption is used to encrypt the symmetric key ( or one can transmit the key material and derive the key with a good KDF like HKDF).