Is EC integrated encryption scheme used in practice?

Question

I know ECDSA and ECDH are used a lot but what about the ECIES? Is it used or specified as an option in any protocol?

Answer 1

Yes, ECIES is used in practice. That's the simplest way (thus arguably the best) to establish a key or/and encipher using Elliptic Curve Cryptography in contexts including unidirectional data transfer, or data-at-rest like backup with encryption under public key.

As an illustration, it is often listed in the Other algorithms section of FIPS-140-validated cryptographic devices; I count like 28 occurrences.

ECIES is in the de-facto standard SEC 1, IEEE Std 1363a-2004, and ANSI X9.63-2011. It is used e.g. in Intelligent Transport Systems as specified by ETSI TS 103 097. The similar ECIES-KEM is in ISO/IEC 18033-2:2006 following a well-documented proposal by Victor Shoup.

Answer 2

Another example is Google's Android Pay:

Android Pay uses Elliptic Curve Integrated Encryption Scheme (ECIES) to secure the payment method token returned in the full Wallet response

Answer 3

It's not exactly as in the standards that fgrieu cited, but libsodium's sealed box abstraction is essentially the same idea.