Subject: Re: [Cfrg] ECC Encryption questions

From: "Blumenthal, Uri - 0668 - MITLL" <[email-masked]>
Date: Thu, 24 Jun 2010 07:47:33 -0400

Let me second the ECIES recommendation.

Regards,
Uri

----- Original Message -----
From: [email-masked] <[email-masked]>
To: Dan Brown <[email-masked]>
Cc: [email-masked]' <[email-masked]>
Sent: Thu Jun 24 06:07:55 2010
Subject: Re: [Cfrg] ECC Encryption questions

On 06/24/2010 01:54 AM, Dan Brown wrote:
> Why not use ECIES? It is standardized in SEC1, IEEE 1363A, ANSI X9.63, and ISO 18033-2.  It also has some provable security properties, which raw ElGamal lacks, yet is almost as efficient as ElGamal.
>    

ECIES was mentioned to me in a private message.  I am trying to get 
access to some source that describes it.  Even though I am an IEEE 
member, that does not get me 1363A.  I am SUPPOSE to have access to ANSI 
as part of NIST CSWG review, but it is complex, but I got to try it 
today.  Where is SEC1?  And ISO, well I don't think I will be seeing an 
ISO document any time soon....

> ----- Original Message -----
> From: Robert Moskowitz [mailto:[email-masked]]
> Sent: Wednesday, June 23, 2010 05:08 PM
> To: [email-masked]<[email-masked]>
> Subject: [Cfrg] ECC Encryption questions
>
> Is there an ECC encryption algorithm similar to RSA Encryption?
>
>         Alice generates her keypair and sends the public value to Bob.
>         Bob uses the public value to encrypt cleartext C and transmits
> the cyphertext to Alice.
>         Alice uses her private value to decrypt to recover C.
>
> All I am finding is the ElGamal Encryption that uses keypairs from both
> Bob or Alice (or at least that is what I am reading at:
> http://en.wikipedia.org/wiki/ElGamal_encryption
>
> The text I need to encrypt is short, typically 256 or 384 bits.
>
> Is there a nice mnemonic for ElGamal Encryption using ECC?
>
> Something like ECEGE?
>
> It gets tiresome to write and read ECC ElGamal Encryption after it
> occurs more than once in a document...
>
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
>
> ---------------------------------------------------------------------
> This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.
>
>    
_______________________________________________
Cfrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/cfrg

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 24 Jun 2010 10:53:34 -0400

>
> I strongly agree with this. ECIES has good provable security properties and the same "interface" as RSA. It requires a hash function, but (a) realistically your PRNG is going to have a hash function inside it anyway unless you have a really good true RNG,

Look at IEEE 802.11 Annex H for how to build your PRNG seed with a few 
ring oscillators.  From there you can use AES-CMAC.  I have been told 
there are other hardware models out there, this is just one that was 
vetted to include in a standard.

> and (b) the use of the hash on the output is the best way of addressing the non-uniformity that you've been concerned about.
>
> William
>
> William Whyte, Chief Scientist
> Security Innovation, 187 Ballardvale St Suite A195, Wilmington, MA 01887
>
> ----- "Uri - 0668 - MITLL Blumenthal"<[email-masked]>  wrote:
>
>    
>> From: [email-masked]<[email-masked]>
>> To: Dan Brown<[email-masked]>
>> Cc: [email-masked]'<[email-masked]>
>>> Why not use ECIES? It is standardized in SEC1, IEEE 1363A, ANSI
>>>        
>> X9.63, and ISO 18033-2.  It also has some provable security
>> properties, which raw ElGamal lacks, yet is almost as efficient as
>> ElGamal.
>>      
>>>
>>>        
>>>          Alice generates her keypair and sends the public value to
>>>        
>> Bob.
>>      
>>>          Bob uses the public value to encrypt cleartext C and
>>>        
>> transmits
>>      
>>> the cyphertext to Alice.
>>> All I am finding is the ElGamal Encryption that uses keypairs from
>>>        
>> both
>>      
>>> This transmission (including any attachments) may contain
>>>        
>> confidential information, privileged material (including material
>> protected by the solicitor-client or other applicable privileges), or
>> constitute non-public information. Any use of this information by
>> anyone other than the intended recipient is prohibited. If you have
>> received this transmission in error, please immediately reply to the
>> sender and delete this information from your system. Use,
>> dissemination, distribution, or reproduction of this transmission by
>> unintended recipients is not authorized and may be unlawful.
>>      
>>>
>>>