4

The Elliptic Curve Integrated Encryption Scheme (ECIES) describes how to derive a "temporal" key, encrypt a message (eg. using AES) and creating a MAC.

However, from my understanding using AES in GCM mode makes using an additional MAC obsolete. So, is it then safe to skip the MAC calculation step in ECIES when using AES-GCM?

User
  • 43
  • 3

1 Answers1

3

It's perfectly safe; GCM provides both the confidentially and integrity guarantees that ECIES requires.

Just a few notes:

  • It doesn't matter what nonce you use; in fact, you can shrink the ciphertext a few bytes by making it implicit (as you'll use this GCM key only once)

  • The AAD information you give GCM can either be empty, or optionally include a shared secret ($S_2$ on the Wikipedia article)

poncho
  • 154,064
  • 12
  • 239
  • 382