8

RSA offers the functionality of encrypting (short messages, or symmetric keys) with a public key, and decrypting with a private key. However, RSA key generation is extremely expensive, especially for 2048-bit+ keys. Is there an algorithm which employs elliptic curve cryptography, fast asymmetric encryption, fast key generation, and small keys sizes?

hunter
  • 4,051
  • 6
  • 29
  • 42

2 Answers2

6

As already mentioned in a previous comment, ECIES (a hybrid encryption scheme) is typically the way to go when implementing asymmetric encryption on elliptic curves, as it is standardized. It provides chosen ciphertext security (IND-CCA).

But as you are looking for "pure" public key encryption schemes, here we go:

ElGamal can not only be implemented in (prime order $q$ subgroups of) $\mathbb{Z}_p^*$ for prime $p$, but equally on elliptic curve groups. It provides chosen plaintext security (IND-CPA).

Furthermore, there are various ElGamal-type schemes I want to mention:

  • Cramer-Shoup is an ElGamal variant that provides IND-CCA security.
  • If you work in a pairing friendly elliptic curve setting, it may be the case that in the group in which you are using the encryption scheme the decisional Diffie-Hellman (DDH) problem is easy. In such a case ElGamal is insecure as it's security relies on the DDH. Here, you can use Linear-encryption, which in contrast to ElGamal relies on the decision linear (DLIN) assumption and stays secure even if the DDH is easy and is also IND-CPA secure.
  • There is also a IND-CCA secure Cramer-Shoup version of linear encryption (but that's rather of theoretical interest).
  • Furthermore, recently I encountered another variant of linear encryption, denoted as linear combination encryption (unfortunately, behind a paywall) which provides IND-CPA security and relies on the decision linear combination (DLC) assumption. It can also be used in groups where the DDH may be easy (however, this scheme is rather esoteric and seems to be tailored to the constructed group signature scheme and the proofs respectively).

The most efficient one of these schemes is the standard ElGamal version.

DrLecter
  • 12,675
  • 3
  • 44
  • 61
1

The ElGamal encryption scheme works in any finite cyclic group $G$, so in particular in the group generated by a $\mathbb{F}_q$-point $P$ on an elliptic curve. Key sizes tend to be a lot smaller over elliptic curves.

chthonian
  • 111
  • 3