Integrated Encryption Scheme

<h2 id="informal-description-of-dlies">Informal description of DLIES</h2>
<p>As a <i>brief and informal</i> description and overview of how IES works, a Discrete Logarithm Integrated Encryption Scheme (DLIES) is used, focusing on illuminating the reader's understanding, rather than precise technical details.
</p>
<ol><li><a href="/facts/Alice_and_Bob/FSHudRmA">Alice</a> learns <a href="/facts/Alice_and_Bob/FSHudRmA">Bob's</a> public key 
  
    
      
        
          g
          
            x
          
        
      
    
    {\displaystyle g^{x}}
  
 through a public key infrastructure or some other distribution method.Bob knows his own private key 
  
    
      
        x
      
    
    {\displaystyle x}
  
.</li>
<li>Alice generates a fresh, ephemeral value 
  
    
      
        y
      
    
    {\displaystyle y}
  
, and its associated public value 
  
    
      
        
          g
          
            y
          
        
      
    
    {\displaystyle g^{y}}
  
.</li>
<li>Alice then computes a symmetric key 
  
    
      
        k
      
    
    {\displaystyle k}
  
 using this information and a <a href="/facts/Key_derivation_function/3jL2jTTb">key derivation function</a> (KDF) as follows: 
  
    
      
        k
        =
        
          
            KDF
          
        
        (
        
          g
          
            x
            y
          
        
        )
      
    
    {\displaystyle k={\textrm {KDF}}(g^{xy})}
  
</li>
<li>Alice computes her ciphertext 
  
    
      
        c
      
    
    {\displaystyle c}
  
 from her actual message 
  
    
      
        m
      
    
    {\displaystyle m}
  
 (by symmetric encryption of 
  
    
      
        m
      
    
    {\displaystyle m}
  
) encrypted with the key 
  
    
      
        k
      
    
    {\displaystyle k}
  
 (using an <a href="/facts/Authenticated_encryption/u3229wI2">authenticated encryption scheme</a>) as follows: 
  
    
      
        c
        =
        E
        (
        k
        ;
        m
        )
      
    
    {\displaystyle c=E(k;m)}
  
</li>
<li>Alice transmits (in a single message) both the public ephemeral 
  
    
      
        
          g
          
            y
          
        
      
    
    {\displaystyle g^{y}}
  
 and the ciphertext 
  
    
      
        c
      
    
    {\displaystyle c}
  
.</li>
<li>Bob, knowing 
  
    
      
        x
      
    
    {\displaystyle x}
  
 and 
  
    
      
        
          g
          
            y
          
        
      
    
    {\displaystyle g^{y}}
  
, can now compute 
  
    
      
        k
        =
        
          
            KDF
          
        
        (
        
          g
          
            x
            y
          
        
        )
      
    
    {\displaystyle k={\textrm {KDF}}(g^{xy})}
  
 and decrypt 
  
    
      
        m
      
    
    {\displaystyle m}
  
 from 
  
    
      
        c
      
    
    {\displaystyle c}
  
.</li></ol>
<p>Note that the scheme does not provide Bob with any assurance as to who really sent the message: This scheme does nothing to stop anyone from pretending to be Alice.
</p>
<h2 id="formal-description-of-ecies">Formal description of ECIES</h2>
<h3>Required information</h3>
<p>To send an encrypted message to Bob using ECIES, Alice needs the following information:
</p>
<ul><li>The cryptography suite to be used, including a <a href="/facts/Key_derivation_function/3jL2jTTb">key derivation function</a> (e.g., <i>ANSI-X9.63-KDF with SHA-1 option</i>), a <a href="/facts/Message_authentication_code/mXxCP5Yl">message authentication code system</a> (e.g., <i>HMAC-SHA-1-160 with 160-bit keys</i> or <i>HMAC-SHA-1-80 with 80-bit keys</i>) and a <a href="/facts/Symmetric-key_algorithm/5zfe0b76">symmetric encryption scheme</a> (e.g., <i><a href="/facts/TDEA/sgzSD50P">TDEA</a> in <a href="/facts/Cipher_block_chaining/vIUabB2z">CBC</a> mode</i> or <i>XOR encryption scheme</i>) — noted 
  
    
      
        E
      
    
    {\displaystyle E}
  
.</li>
<li>The elliptic curve domain parameters: 
  
    
      
        (
        p
        ,
        a
        ,
        b
        ,
        G
        ,
        n
        ,
        h
        )
      
    
    {\displaystyle (p,a,b,G,n,h)}
  
 for a curve over a prime field or 
  
    
      
        (
        m
        ,
        f
        (
        x
        )
        ,
        a
        ,
        b
        ,
        G
        ,
        n
        ,
        h
        )
      
    
    {\displaystyle (m,f(x),a,b,G,n,h)}
  
 for a curve over a binary field.</li>
<li>Bob's public key 
  
    
      
        
          K
          
            B
          
        
      
    
    {\displaystyle K_{B}}
  
, which Bob generates it as follows: 
  
    
      
        
          K
          
            B
          
        
        =
        
          k
          
            B
          
        
        G
      
    
    {\displaystyle K_{B}=k_{B}G}
  
, where 
  
    
      
        
          k
          
            B
          
        
        ∈
        [
        1
        ,
        n
        −
        1
        ]
      
    
    {\displaystyle k_{B}\in [1,n-1]}
  
 is the private key he chooses at random.</li>
<li>Some optional shared information: 
  
    
      
        
          S
          
            1
          
        
      
    
    {\displaystyle S_{1}}
  
 and 
  
    
      
        
          S
          
            2
          
        
      
    
    {\displaystyle S_{2}}
  
</li>
<li>
  
    
      
        O
      
    
    {\displaystyle O}
  
 which denotes the <a href="/facts/Elliptic_curve/60jvaHSA">point at infinity</a>.</li></ul>
<h3>Encryption</h3>
<p>To encrypt a message 
  
    
      
        m
      
    
    {\displaystyle m}
  
 Alice does the following:
</p>
<ol><li>generates a random number 
  
    
      
        r
        ∈
        [
        1
        ,
        n
        −
        1
        ]
      
    
    {\displaystyle r\in [1,n-1]}
  
 and calculates 
  
    
      
        R
        =
        r
        G
      
    
    {\displaystyle R=rG}
  
</li>
<li>derives a shared secret: 
  
    
      
        S
        =
        
          P
          
            x
          
        
      
    
    {\displaystyle S=P_{x}}
  
, where 
  
    
      
        P
        =
        (
        
          P
          
            x
          
        
        ,
        
          P
          
            y
          
        
        )
        =
        r
        
          K
          
            B
          
        
      
    
    {\displaystyle P=(P_{x},P_{y})=rK_{B}}
  
 (and 
  
    
      
        P
        ≠
        O
      
    
    {\displaystyle P\neq O}
  
)</li>
<li>uses a <a href="/facts/Key_derivation_function/3jL2jTTb">KDF</a> to derive symmetric encryption keys and <a href="/facts/Message_authentication_code/mXxCP5Yl">MAC</a> keys: 
  
    
      
        
          k
          
            E
          
        
        ‖
        
          k
          
            M
          
        
        =
        
          
            KDF
          
        
        (
        S
        ‖
        
          S
          
            1
          
        
        )
      
    
    {\displaystyle k_{E}\|k_{M}={\textrm {KDF}}(S\|S_{1})}
  
</li>
<li>encrypts the message: 
  
    
      
        c
        =
        E
        (
        
          k
          
            E
          
        
        ;
        m
        )
      
    
    {\displaystyle c=E(k_{E};m)}
  
</li>
<li>computes the tag of encrypted message and 
  
    
      
        
          S
          
            2
          
        
      
    
    {\displaystyle S_{2}}
  
: 
  
    
      
        d
        =
        
          
            MAC
          
        
        (
        
          k
          
            M
          
        
        ;
        c
        ‖
        
          S
          
            2
          
        
        )
      
    
    {\displaystyle d={\textrm {MAC}}(k_{M};c\|S_{2})}
  
</li>
<li>outputs 
  
    
      
        R
        ‖
        c
        ‖
        d
      
    
    {\displaystyle R\|c\|d}
  
</li></ol>
<h3>Decryption</h3>
<p>To decrypt the ciphertext 
  
    
      
        R
        ‖
        c
        ‖
        d
      
    
    {\displaystyle R\|c\|d}
  
 Bob does the following:
</p>
<ol><li>derives the shared secret: 
  
    
      
        S
        =
        
          P
          
            x
          
        
      
    
    {\displaystyle S=P_{x}}
  
, where 
  
    
      
        P
        =
        (
        
          P
          
            x
          
        
        ,
        
          P
          
            y
          
        
        )
        =
        
          k
          
            B
          
        
        R
      
    
    {\displaystyle P=(P_{x},P_{y})=k_{B}R}
  
 (it is the same as the one Alice derived because 
  
    
      
        P
        =
        
          k
          
            B
          
        
        R
        =
        
          k
          
            B
          
        
        r
        G
        =
        r
        
          k
          
            B
          
        
        G
        =
        r
        
          K
          
            B
          
        
      
    
    {\displaystyle P=k_{B}R=k_{B}rG=rk_{B}G=rK_{B}}
  
), or outputs <i>failed</i> if 
  
    
      
        P
        =
        O
      
    
    {\displaystyle P=O}
  
</li>
<li>derives keys the same way as Alice did: 
  
    
      
        
          k
          
            E
          
        
        ‖
        
          k
          
            M
          
        
        =
        
          
            KDF
          
        
        (
        S
        ‖
        
          S
          
            1
          
        
        )
      
    
    {\displaystyle k_{E}\|k_{M}={\textrm {KDF}}(S\|S_{1})}
  
</li>
<li>uses <a href="/facts/Message_authentication_code/mXxCP5Yl">MAC</a> to check the tag and outputs <i>failed</i> if 
  
    
      
        d
        ≠
        
          
            MAC
          
        
        (
        
          k
          
            M
          
        
        ;
        c
        ‖
        
          S
          
            2
          
        
        )
      
    
    {\displaystyle d\neq {\textrm {MAC}}(k_{M};c\|S_{2})}
  
</li>
<li>uses symmetric encryption scheme to decrypt the message 
  
    
      
        m
        =
        
          E
          
            −
            1
          
        
        (
        
          k
          
            E
          
        
        ;
        c
        )
      
    
    {\displaystyle m=E^{-1}(k_{E};c)}
  
</li></ol>

<ul><li><a href="/facts/SECG/dEGml43n">SECG</a>, <a href="http://www.secg.org/sec1-v2.pdf">Standards for efficient cryptography, SEC 1: Elliptic Curve Cryptography</a>, Version 2.0, May 21, 2009.</li>
<li>Gayoso Martínez, Hernández Encinas, Sánchez Ávila: <i><a href="https://www.researchgate.net/publication/255970113_A_Survey_of_the_Elliptic_Curve_Integrated_Encryption_Scheme">A Survey of the Elliptic Curve Integrated Encryption Scheme</a></i>, Journal of Computer Science and Engineering, 2, 2 (2010), 7–13.</li>
<li>Ladar Levison: <a href="http://article.gmane.org/gmane.comp.encryption.openssl.devel/17997/">Code for using ECIES to protect data (ECC + AES + SHA)</a>, openssl-devel mailing list, August 6, 2010.</li>
<li><a href="/facts/IEEE_P1363/pEjW4GjI">IEEE 1363a</a> (non-public standard) specifies DLIES and ECIES</li>
<li>ANSI X9.63 (non-public standard)</li>
<li>ISO/IEC 18033-2 (non-public standard)</li>
<li>Victor Shoup, <a href="http://www.shoup.net/papers/iso-2_1.pdf">A proposal for an ISO standard for public key encryption</a>, Version 2.1, December 20, 2001.</li>
<li>Abdalla, Michel and Bellare, Mihir and Rogaway, Phillip: <a href="http://web.cs.ucdavis.edu/~rogaway/papers/dhies.pdf">DHIES: An Encryption Scheme Based on the Diffie–Hellman Problem</a>, IACR Cryptology ePrint Archive, 1999.</li></ul>

Integrated Encryption Scheme open-in-new

Integrated Encryption Scheme