I am wondering if ECC could be used the way that the data is encrypted with the public key instead of the random generated key.

Is there any advantage doing that comparing to the "traditional" way of using symmetric + asymmetric encryption together, just like PGP does.

PGP diagram (from Wikimedia commons)

2 Answers 2


The ElGamal asymmetric encryption scheme can be adapted to elliptic curves (indeed, it works on any finite group for which discrete logarithm is hard). However, this means that the data to encrypt must be mapped to a curve point in a reversible manner, which is a bit tricky (that's doable but involves more mathematics, which means increased implementation code size). Since most of the time we use asymmetric encryption, we actually want to encrypt a session key which will be used for symmetric encryption, Diffie-Hellman key exchange on the elliptic curve is already fine, and simpler (that's what ECIES is: Diffie-Hellman then symmetric encryption).

  • Yeah, I was wondering if there was some test on the web comparing these options. Thanks for the info.
    – Istvan
    Oct 5, 2012 at 3:35

ECC can be used to encrypt the data itself with the public key instead of encrypting a random key and then symmetrically encrypting the data with that random key. But this is not a good idea as explained in Thomas Pornin's answer to In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?.

In any case ECIES uses a symmetric encryption algorithm to actually encrypt the data, so even if you use ECC to encrypt all the data, you're still encrypting it with a random symmetric key. But if you're encrypting the data itself with ECIES you could use a simple XOR as the symmetric encryption algorithm, which is effectively a one-time-pad. This has a theoretical advantage in that, unlike other symmetric encryption algorithms, one-time-pads are information-theoretically secure.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .