ECIES is part of both ISO/IEC and IEEE. There's a interop bug between Crypto++'s ECIES and Bouncy Castle's ECIES. I know where the bug lies, and I've been trying to determine who is "right" (for some definition of "right").
The bug is simply the length of the label
L. In Crypto++, the length of the label is encoded in an 8-byte word, while Bouncy Castle uses a 4-byte word for the label. Obviously, the
mac.Update(L, 4) and
mac.Update(L, 8) will produce different results.
The proposal is sufficiently vague in this particular area, so its easy to understand why the interop bug exists. I've searched Shoup's site, but I can't find a reference implementation.
IEEE is hidden behind a paywall, so its hard to say what they consider standard. It could well be that both are "right" because they are using slightly different standards. (I know Shoup points out some differences in his 2.1 draft).
Where can I find a reference implementation of Shoup's ECIES (preferably from Victor Shoup himself)?
Related: the reason I'm interested in this information is I would like to work on an implementation in OpenSSL. So the implementation needs to be "right", and it needs to interoperate with the Crypto++ and Bouncy Castle implementations (even if that means a flag to do the "not-right" thing on occassion).