12
votes
Accepted
ECIES need for KDF
Do not skip the KDF step.
The output of an ECDH key agreement, as used inside ECIES, is some encoding of a point on a curve. Usually the encoding is highly structured and not uniformly distributed ...
- 49.1k
11
votes
Accepted
ECIES/ ECDHE/ EC-ElGamal encryption comparison
Fix a group $G$ of order $q$ in which discrete logs are hard, and fix a standard base point $g \in G$. Fix an authenticated cipher $E_k$ of bit strings.
In (EC)IES, roughly: A public key is a point ...
- 49.1k
11
votes
Accepted
ECIES vs. RSA + AES
Is this correct?
The principles are right, but a number of details are missing. Among these:
For RSA
"Encrypt the file" can't be with AES only, since that's a 128-bit block cipher, and it ...
- 144k
9
votes
Accepted
Is EC integrated encryption scheme used in practice?
Yes, ECIES is used in practice. That's the simplest way (thus arguably the best) to establish a key or/and encipher using Elliptic Curve Cryptography in contexts including unidirectional data transfer,...
- 144k
8
votes
Accepted
ECIES with ECDSA
Generally you need to use sign-then-encrypt. It is probably better to keep those separate.
So then the cryptographic message becomes: $$\text{ECIES}(P_B, M \| \text{ECDSA}(S_A, M))$$
where $A$ is ...
- 93.9k
6
votes
Accepted
Do I need to know the curve for ECIES decryption?
This awfully looks like homework, but hey, here we go. Each curve has an order, which is the number of points on the curve (specifically, the number of points into a subgroup of prime order of the ...
- 87.7k
6
votes
Is IV needed in ECIES?
Pedantically, you always have an IV with AES-CTR; you need to start counting somewhere. So, your question really is "do I need an explicit IV, or can I use an implicit all-0 IV"?
With AES-CTR, the ...
- 150k
6
votes
Is EC integrated encryption scheme used in practice?
Another example is Google's Android Pay:
Android Pay uses Elliptic Curve Integrated Encryption Scheme (ECIES)
to secure the payment method token returned in the full Wallet
response
- 5,032
6
votes
Accepted
How to know that MAC isn't modified in ECIES
This actually apply to symmetric-key encryption in general, and isn't specific to ECC.
In short: if either ciphertext or MAC is modified, then the decryption fails as whole. There's no way to ...
- 9,662
5
votes
Is EC integrated encryption scheme used in practice?
It's not exactly as in the standards that fgrieu cited, but libsodium's sealed box abstraction is essentially the same idea.
- 49.1k
5
votes
Accepted
Does this ECIES scheme make MAC redundant?
From the standpoint of integrity and proof of origin, signature is a superset of MAC, with the tremendous operational benefit that no secret is required for verification (drawbacks include larger size,...
- 144k
5
votes
Accepted
ECIES for encrypting ECDH key exchange
Elliptic Curve Integrated Encryption Scheme (ECIES) is a type of Integrated Encryption Scheme (IES) that uses Elliptic-Curve Diffie-Hellman (ECDH) key agreement to establish an ephemeral data key (...
- 93.9k
5
votes
Accepted
Why does ECIES use "Key Encapsulation"? Does it?
Now I've always thought that "encapsulation" is almost synonymous with encryption.
You protect a pre-established value using a mechanism.
This is not how the term has ever been used in the ...
- 66
4
votes
Accepted
ECIES for not shared encryption
Yes, however I believe that the reason is a bit subtler than what fgrieu gave.
From your question, I don't believe that you're actually doing standard ECIES, but instead something such as NaCl's ...
- 150k
4
votes
Accepted
ECIES: ECDSA with Kmac and without MAC
There are issues in the question, some serious. In reading order:
ECIES(Bob's public key, M || ECDSA(Alice's static private key, M)) is sign-then-encrypt, which is ...
- 144k
4
votes
Accepted
Plaintext Size Limit for ECIES with AES-128 CBC mode
You are using CBC mode in ECIES. In the CBC mode the $i$-th ciphertext is calculated as
$$c_i = E_k(m_i \oplus c_{i-1})$$
where the $c_0=IV$
Now, there is a problem with CBC mode that is if the ...
- 49.3k
4
votes
Accepted
Using XOR to derive a data key for ECIES
As written, it makes an additional security assumption on the symmetric cipher; that the attacker can't flip bits in the key (and modify the ciphertext) to gain some advantage. That is likely true ...
- 150k
4
votes
Modified ECIES using EC point ADD with DH key
Is there a name for (what I so presumptuously) called Cyon ECIES?
No. Though it comes close to how crypto_box works: Using static Diffie-Hellman with extra ...
- 46.3k
3
votes
Accepted
Differences between ECIES and DHIES
ECIES is DHIES restricted to an Elliptic Curve group, when DHIES is defined for any cyclic group, including but not limited to $\Bbb Z_p^*$.
Mihir Bellare writes on his web page on DHIES: An ...
- 144k
3
votes
Is it secure to encrypt a 1 GB data file with AES-CTR by ECIES?
The short answer is yes, ECIES can absolutely be instantiated with AES-CTR.
This bit of the question is slightly worrisome:
Is it possible to use the client's ECC public key to encrypt the AES key,...
- 14.6k
3
votes
Accepted
Is it secure to encrypt a 1 GB data file with AES-CTR by ECIES?
I do not believe there would be any issues, as long as:
The problem you are attempting to solve is that you want to encrypt a file so that the client can decrypt it, but no one else can
The client ...
- 150k
3
votes
Accepted
Ethereum RLPx protocol for inter-node communication - flaws in the encryption
Firstly, CTR mode. This is a stream mode that allows a block cipher (AES here) to work as a stream cipher.
Given $(k,IV)$ where $k$ is a random encryption key and $IV$ is an initialization vector, ...
- 4,198
3
votes
Accepted
What's the ASN.1 structure of ECIES encryption result?
The public key structure is an X.509 SubjectPublicKeyInfo for ECC (public) key, using explicit format instead of (more common and popular) 'named' format. SPKI is a generic ASN.1 structure that ...
- 6,424
3
votes
Accepted
Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?
So the question is if ECIES gives by default IND-CCA2 security?
Yes it does. There's a proof in modern Cryptography by Katz and Lindell, but I'll leave that one to Yehuda to write an answer around. ...
- 46.3k
3
votes
How to implement correctly an Integrated Encryption Scheme?
You have the right idea! There's a very general construction for public-key encryption called KEM/DEM that works as follows to encrypt a message $m$:
Key encapsulation mechanism, KEM: Generate a key ...
- 49.1k
3
votes
Accepted
is using secp256k1 curve for ECIES considered safe?
How much Unsafe is using secp256k1 for ECIES and what dangers/weakness it exposes /what attack it makes possible?
Let's have a look through the "failures" that secp256k1 achieves according to ...
- 46.3k
3
votes
Accepted
Clarification on hybrid encryption vs ECIES vs symmetric encrypt the message and then use assymetric for key
A hybrid cryptosystem is a public-key cryptosystem which uses symmetric cryptography for some of its internal operation. Encrypting a symmetric key with a public key is one way to do hybrid encryption,...
3
votes
Accepted
How does the ECIES-AES encryption work with a key size that is not supported by AES?
the shared key is 521-bits
The shared secret is an elliptic curve point, and so the entropy is not evenly distributed. Therefore, you need to use HKDF on the shared secret anyway. You can use HKDF ...
- 4,760
2
votes
ECIES public key distribution
I see three options for you, each with strengths and weaknesses.
Use a PKI with some sort of trusted signing authority and validate that the certificate is signed by a trusted signing authority and ...
- 38.8k
2
votes
How do I avoid random output in ECIES encryption and Elgamal encryption as well?
I have a case where to ensure the same encrypted string for the given input.
For symmetric encryption, that's actually a common case. It does leak if two different ciphertexts correspond to the same ...
- 150k
Only top scored, non community-wiki answers of a minimum length are eligible