Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am wondering if ECC could be used the way that the data is encrypted with the public key instead of the random generated key.

Is there any advantage doing that comparing to the "traditional" way of using symmetric + asymmetric encryption together, just like PGP does.

PGP diagram (from Wikimedia commons)

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The ElGamal asymmetric encryption scheme can be adapted to elliptic curves (indeed, it works on any finite group for which discrete logarithm is hard). However, this means that the data to encrypt must be mapped to a curve point in a reversible manner, which is a bit tricky (that's doable but involves more mathematics, which means increased implementation code size). Since most of the time we use asymmetric encryption, we actually want to encrypt a session key which will be used for symmetric encryption, Diffie-Hellman key exchange on the elliptic curve is already fine, and simpler (that's what ECIES is: Diffie-Hellman then symmetric encryption).

share|improve this answer
    
Yeah, I was wondering if there was some test on the web comparing these options. Thanks for the info. –  Istvan Oct 5 '12 at 3:35

ECC can be used to encrypt the data itself with the public key instead of encrypting a random key and then symmetrically encrypting the data with that random key. But this is not a good idea as explained in Thomas Pornin's answer to In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?.

In any case ECIES uses a symmetric encryption algorithm to actually encrypt the data, so even if you use ECC to encrypt all the data, you're still encrypting it with a random symmetric key. But if you're encrypting the data itself with ECIES you could use a simple XOR as the symmetric encryption algorithm, which is effectively a one-time-pad. This has a theoretical advantage in that, unlike other symmetric encryption algorithms, one-time-pads are information-theoretically secure.

share|improve this answer
    
Thanks for the links! –  Istvan Oct 5 '12 at 3:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.