0

I can't understand the ECIES algorithm.

I saw two different ECIES algorithms:

  1. Using only Public key

    Key generation:

    $A_{pri} : n_A$
    $A_{pub} : n_A G$

    $B_{pri} : n_B$
    $B_{pub} : n_B G$

    Encryption:

    Select a random $k$.

    A -> B to Cipher C : $\{kG, \text{message} + k B_{pub}\}$

    Decryption

    $\text{message} + k B_{pub} - n_B kG = message + k n_B G - n_B k G = \text{message}$

  2. Using Symmetric key(AES)

what is real?

CodesInChaos
  • 24,841
  • 2
  • 89
  • 128
pftpmlp
  • 77
  • 1
  • 4

1 Answers1

1

Yes, ECIES is essentially a more practical implementation of ElGamal, a hybrid cryptosystem. It uses symmetric encryption following an ephemeral key exchange.

Refer to : https://en.wikipedia.org/wiki/Integrated_Encryption_Scheme

Compare it with : https://en.wikipedia.org/wiki/ElGamal_encryption

The only difference is that instead of using KDF+XOR or AES+GCM as the symmetric cipher, ElGamal specifies a different symmetric step mapping the message to a point and using inverse modulo to recover.

Once of the oddities is that using a KDF and then using XOR was the most popular version of ECIES for a number of years. If used carefully, it's OK, but without properly padding the message, things can get ugly (chosen ciphertext attacks, etc.)

Ditching XOR and using AES/GCM with the shared secret seems, to me, like the better move, shifting responsibility for the authentication onto the symmetric layer. The use of KDF/XOR is still prevalent in modern libraries, mostly because some XOR variants were FIPS certified.

Erik Aronesty
  • 440
  • 2
  • 14
  • Please explain, or at least quote, the substantive parts of the links you cite. Links may change and don't help a reader on this site. – Squeamish Ossifrage Jul 17 '18 at 21:51
  • 3
    ECIES is not an instance of or implementation of Elgamal encryption. Elgamal encryption encrypts a point on the curve; ECIES encrypts a bit string under a symmetric-key cipher with a key derived from a public-key key agreement. They are not related except in that they use a group in which discrete logs are hard. – Squeamish Ossifrage Jul 17 '18 at 21:53