Assume: + Alice and Bob both generate separate EC keypairs + Alice obtains Bob\'

Question

Assume:

+ Alice and Bob both generate separate EC keypairs

+ Alice obtains Bob's public key, and together with her private key creates a shared secret key

+ Alice encrypts a message using the shared key and some mode of authenticated encryption (AES-GCM, for example)

+ Bob generates the same shared secret key using his private key and Alice's public key

+ Bob decrypts the message, paying attention to whether or not the auth-tag is valid

My question is; if Bob is confident that Alice's public key really belongs to Alice, then can he be confident that it was Alice who encrypted the message? Or to put it another way, in this scenario does the auth-tag effectively serve as a signature created with a public-key? Intuitively I want to say yes, but I just want to make sure I'm not overlooking anything.

Explanation / Answer

It depends on exactly what protocol you're asking about.

ECIES as design gives no assurance to Bob that the message really came from Alice.

This is, with standard ECIES, Alice does not use her private key -- instead, everything that Alice does (encrypt using Bob's public key) could have been done equally well by someone else - hence, Bob has no cryptographical assurance that the message really came from Alice.

Remember, ECIEC is designed to be a public key encryption system; that's precisely what it does, and public key encryption does not necessarily imply sender authentication.

On the other hand, you state "Alice obtains Bob's public key, and together with her private key creates a shared secret key"; you might by that mean that you don't use standard ECIES; instead of the random number, she uses her ECIES private key.

With that modification, it turns out that the protocol is still secure, and in fact does give source authentication; a message from Alice to Bob can be generated by either Alice or Bob, but no one else without Alice or Bob's private key. In addition, in IES, it's optional whether you use a nonce to stir into the KDF -- with this modification, its use is strongly recommended -- otherwise, any message between Alice and Bob will use the same symmetric key, and that's worth avoiding.

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.