Integrated Encryption Scheme

Integrated Encryption Scheme (IES) is a public-key encryption scheme which provides semantic security against an adversary who is allowed to use chosen-plaintext and chosen-ciphertext attacks. The scheme is based on Diffie–Hellman problem. Two incarnations of the IES are standardized: Discrete Logarithm Integrated Encryption Scheme (DLIES) and Elliptic Curve Integrated Encryption Scheme (ECIES), which is also known as the Elliptic Curve Augmented Encryption Scheme or simply the Elliptic Curve Encryption Scheme. These two incarnations are identical up to the change of an underlying group and so to be concrete we concentrate on the latter.

To send an encrypted message to Bob using ECIES Alice needs the following information:

• cryptographic suite to be used:
  • KDF, e.g., ANSI-X9.63-KDF with SHA-1 option;
  • MAC, e.g., HMAC-SHA-1-160 with 160-bit keys or HMAC-SHA-1-80 with 80-bit keys;
  • symmetric encryption scheme ${\displaystyle E}$, e.g., TDEA in CBC mode or XOR encryption scheme;
• EC domain parameters: ${\displaystyle (p,a,b,G,n,h)}$ for a curve over prime field or ${\displaystyle (m,f(x),a,b,G,n,h)}$ for a curve over binary field;
• Bob's public key: ${\displaystyle K_B}$ (Bob generates it as follows: ${\displaystyle K_B = k_B G}$, where ${\displaystyle k_B}$ is the private key he chooses at random: ${\displaystyle k_B \in [1, n-1]}$);
• optional shared information: ${\displaystyle S_1}$ and ${\displaystyle S_2}$.

To encrypt a message ${\displaystyle m}$ Alice does the following:

1. generates a random number ${\displaystyle r \in [1, n-1]}$ and calculates ${\displaystyle R = r G}$;
2. derives a shared secret: ${\displaystyle S = P_x}$, where ${\displaystyle P = (P_x, P_y) = r K_B}$ (and ${\displaystyle P \ne O}$);
3. uses KDF to derive a symmetric encryption and a MAC keys: ${\displaystyle k_E \| k_M = \textrm{KDF}(S\|S_1)}$;
4. encrypts the message: ${\displaystyle c = E(k_E; m)}$;
5. computes the tag of encrypted message and ${\displaystyle S_2}$: ${\displaystyle d = \textrm{MAC}(k_M; c \| S_2)}$;
6. outputs ${\displaystyle R \| c \| d}$.

To decrypt the ciphertext ${\displaystyle R \| c \| d}$ Bob does the following:

1. derives the shared secret: ${\displaystyle S = P_x}$, where ${\displaystyle P = (P_x, P_y) = k_B R}$ (it is the same as the one Alice derived because ${\displaystyle P = k_B R = k_B r G = r k_B G = r K_B}$), or outputs failed if ${\displaystyle P=O}$;
2. derives keys the same way as Alice did: ${\displaystyle k_E \| k_M = \textrm{KDF}(S\|S_1)}$;
3. uses MAC to check the tag and outputs failed if ${\displaystyle d \ne \textrm{MAC}(k_M; c \| S_2)}$;
4. uses symmetric encryption scheme to decrypt the message ${\displaystyle m = E^{-1}(k_E; c)}$.

References[]

• Victor Shoup, A proposal for an ISO standard for public key encryption, Version 2.1, December 20, 2001.
• Certicom Research, Standards for efficient cryptography, SEC 1: Elliptic Curve Cryptography, Version 1.0, September 20, 2000.

de:Elliptic Curve Integrated Encryption Scheme