Integrated Encryption Scheme

To send an encrypted message to Bob using ECIES, Alice needs the following information:

• cryptographic suite to be used, including a key derivation function (e.g., ANSI-X9.63-KDF with SHA-1 option), a message authentication code (e.g., HMAC-SHA-1-160 with 160-bit keys or HMAC-SHA-1-80 with 80-bit keys) and a symmetric encryption scheme (e.g., TDEA in CBC mode or XOR encryption scheme)—noted ${\displaystyle E}$;
• elliptic curve domain parameters: ${\displaystyle (p,a,b,G,n,h)}$ for a curve over a prime field or ${\displaystyle (m,f(x),a,b,G,n,h)}$ for a curve over a binary field;
• Bob's public key: ${\displaystyle K_{B}}$ (Bob generates it as follows: ${\displaystyle K_{B}=k_{B}G}$, where ${\displaystyle k_{B}}$ is the private key he chooses at random: ${\displaystyle k_{B}\in [1,n-1]}$);
• optional shared information: ${\displaystyle S_{1}}$ and ${\displaystyle S_{2}}$.
• ${\displaystyle O}$ denotes the point at infinity

To encrypt a message ${\displaystyle m}$ Alice does the following:

1. generates a random number ${\displaystyle r\in [1,n-1]}$ and calculates ${\displaystyle R=rG}$;
2. derives a shared secret: ${\displaystyle S=P_{x}}$, where ${\displaystyle P=(P_{x},P_{y})=rK_{B}}$ (and ${\displaystyle P\neq O}$);
3. uses a KDF to derive symmetric encryption keys and MAC keys: ${\displaystyle k_{E}\|k_{M}={\textrm {KDF}}(S\|S_{1})}$;
4. encrypts the message: ${\displaystyle c=E(k_{E};m)}$;
5. computes the tag of encrypted message and ${\displaystyle S_{2}}$: ${\displaystyle d={\textrm {MAC}}(k_{M};c\|S_{2})}$;
6. outputs ${\displaystyle R\|c\|d}$.

To decrypt the ciphertext ${\displaystyle R\|c\|d}$ Bob does the following:

1. derives the shared secret: ${\displaystyle S=P_{x}}$, where ${\displaystyle P=(P_{x},P_{y})=k_{B}R}$ (it is the same as the one Alice derived because ${\displaystyle P=k_{B}R=k_{B}rG=rk_{B}G=rK_{B}}$), or outputs failed if ${\displaystyle P=O}$;
2. derives keys the same way as Alice did: ${\displaystyle k_{E}\|k_{M}={\textrm {KDF}}(S\|S_{1})}$;
3. uses MAC to check the tag and outputs failed if ${\displaystyle d\neq {\textrm {MAC}}(k_{M};c\|S_{2})}$;
4. uses symmetric encryption scheme to decrypt the message ${\displaystyle m=E^{-1}(k_{E};c)}$.