# Tag Info

Accepted

### ECIES need for KDF

Do not skip the KDF step. The output of an ECDH key agreement, as used inside ECIES, is some encoding of a point on a curve. Usually the encoding is highly structured and not uniformly distributed ...
• 49.1k
Accepted

### ECIES/ ECDHE/ EC-ElGamal encryption comparison

Fix a group $G$ of order $q$ in which discrete logs are hard, and fix a standard base point $g \in G$. Fix an authenticated cipher $E_k$ of bit strings. In (EC)IES, roughly: A public key is a point ...
• 49.1k
Accepted

### ECIES vs. RSA + AES

Is this correct? The principles are right, but a number of details are missing. Among these: For RSA "Encrypt the file" can't be with AES only, since that's a 128-bit block cipher, and it ...
• 144k
Accepted

### Is EC integrated encryption scheme used in practice?

Yes, ECIES is used in practice. That's the simplest way (thus arguably the best) to establish a key or/and encipher using Elliptic Curve Cryptography in contexts including unidirectional data transfer,...
• 144k
Accepted

### ECIES with ECDSA

Generally you need to use sign-then-encrypt. It is probably better to keep those separate. So then the cryptographic message becomes: $$\text{ECIES}(P_B, M \| \text{ECDSA}(S_A, M))$$ where $A$ is ...
• 93.9k
Accepted

### Do I need to know the curve for ECIES decryption?

This awfully looks like homework, but hey, here we go. Each curve has an order, which is the number of points on the curve (specifically, the number of points into a subgroup of prime order of the ...
• 87.7k

### Is IV needed in ECIES?

Pedantically, you always have an IV with AES-CTR; you need to start counting somewhere. So, your question really is "do I need an explicit IV, or can I use an implicit all-0 IV"? With AES-CTR, the ...
• 150k

### Is EC integrated encryption scheme used in practice?

Another example is Google's Android Pay: Android Pay uses Elliptic Curve Integrated Encryption Scheme (ECIES) to secure the payment method token returned in the full Wallet response
• 5,032
Accepted

### How to know that MAC isn't modified in ECIES

This actually apply to symmetric-key encryption in general, and isn't specific to ECC. In short: if either ciphertext or MAC is modified, then the decryption fails as whole. There's no way to ...
• 9,662

### Is EC integrated encryption scheme used in practice?

It's not exactly as in the standards that fgrieu cited, but libsodium's sealed box abstraction is essentially the same idea.
• 49.1k
Accepted

### Does this ECIES scheme make MAC redundant?

From the standpoint of integrity and proof of origin, signature is a superset of MAC, with the tremendous operational benefit that no secret is required for verification (drawbacks include larger size,...
• 144k
Accepted

### ECIES for encrypting ECDH key exchange

Elliptic Curve Integrated Encryption Scheme (ECIES) is a type of Integrated Encryption Scheme (IES) that uses Elliptic-Curve Diffie-Hellman (ECDH) key agreement to establish an ephemeral data key (...
• 93.9k
Accepted

### Why does ECIES use "Key Encapsulation"? Does it?

Now I've always thought that "encapsulation" is almost synonymous with encryption. You protect a pre-established value using a mechanism. This is not how the term has ever been used in the ...
Accepted

### ECIES for not shared encryption

Yes, however I believe that the reason is a bit subtler than what fgrieu gave. From your question, I don't believe that you're actually doing standard ECIES, but instead something such as NaCl's ...
• 150k
Accepted

### ECIES: ECDSA with Kmac and without MAC

There are issues in the question, some serious. In reading order: ECIES(Bob's public key, M || ECDSA(Alice's static private key, M)) is sign-then-encrypt, which is ...
• 144k
Accepted

### Plaintext Size Limit for ECIES with AES-128 CBC mode

You are using CBC mode in ECIES. In the CBC mode the $i$-th ciphertext is calculated as $$c_i = E_k(m_i \oplus c_{i-1})$$ where the $c_0=IV$ Now, there is a problem with CBC mode that is if the ...
• 49.3k
Accepted

### Using XOR to derive a data key for ECIES

As written, it makes an additional security assumption on the symmetric cipher; that the attacker can't flip bits in the key (and modify the ciphertext) to gain some advantage. That is likely true ...
• 150k

### Modified ECIES using EC point ADD with DH key

Is there a name for (what I so presumptuously) called Cyon ECIES? No. Though it comes close to how crypto_box works: Using static Diffie-Hellman with extra ...
• 46.3k
Accepted

### Differences between ECIES and DHIES

ECIES is DHIES restricted to an Elliptic Curve group, when DHIES is defined for any cyclic group, including but not limited to $\Bbb Z_p^*$. Mihir Bellare writes on his web page on DHIES: An ...
• 144k

### Is it secure to encrypt a 1 GB data file with AES-CTR by ECIES?

The short answer is yes, ECIES can absolutely be instantiated with AES-CTR. This bit of the question is slightly worrisome: Is it possible to use the client's ECC public key to encrypt the AES key,...
• 14.6k
Accepted

### Is it secure to encrypt a 1 GB data file with AES-CTR by ECIES?

I do not believe there would be any issues, as long as: The problem you are attempting to solve is that you want to encrypt a file so that the client can decrypt it, but no one else can The client ...
• 150k
Accepted

### Ethereum RLPx protocol for inter-node communication - flaws in the encryption

Firstly, CTR mode. This is a stream mode that allows a block cipher (AES here) to work as a stream cipher. Given $(k,IV)$ where $k$ is a random encryption key and $IV$ is an initialization vector, ...
• 4,198
Accepted

### What's the ASN.1 structure of ECIES encryption result?

The public key structure is an X.509 SubjectPublicKeyInfo for ECC (public) key, using explicit format instead of (more common and popular) 'named' format. SPKI is a generic ASN.1 structure that ...
• 6,424
Accepted

### Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

So the question is if ECIES gives by default IND-CCA2 security? Yes it does. There's a proof in modern Cryptography by Katz and Lindell, but I'll leave that one to Yehuda to write an answer around. ...
• 46.3k

### How to implement correctly an Integrated Encryption Scheme?

You have the right idea! There's a very general construction for public-key encryption called KEM/DEM that works as follows to encrypt a message $m$: Key encapsulation mechanism, KEM: Generate a key ...
• 49.1k
Accepted

### is using secp256k1 curve for ECIES considered safe?

How much Unsafe is using secp256k1 for ECIES and what dangers/weakness it exposes /what attack it makes possible? Let's have a look through the "failures" that secp256k1 achieves according to ...
• 46.3k
Accepted

### Clarification on hybrid encryption vs ECIES vs symmetric encrypt the message and then use assymetric for key

A hybrid cryptosystem is a public-key cryptosystem which uses symmetric cryptography for some of its internal operation. Encrypting a symmetric key with a public key is one way to do hybrid encryption,...
Accepted

### How does the ECIES-AES encryption work with a key size that is not supported by AES?

the shared key is 521-bits The shared secret is an elliptic curve point, and so the entropy is not evenly distributed. Therefore, you need to use HKDF on the shared secret anyway. You can use HKDF ...
• 4,760