Hybrid encryption protects large messages by combining asymmetric encryption or key exchange with symmetric authenticated encryption. It keeps the convenient public-key interface while avoiding asymmetric encryption’s small message limits and slower performance. section 6.2 section 6.2.2
A basic hybrid-encryption exchange proceeds as follows:
- Generate a fresh symmetric key and use authenticated encryption to encrypt the message. section 6.2.2
- Encrypt the symmetric key with the recipient’s public key. section 6.2.2
- Send the encrypted symmetric key and encrypted message together. section 6.2.2
- Have the recipient decrypt the symmetric key with the private key, then decrypt the message with authenticated encryption. section 6.2.2
Authenticated encryption matters: plain symmetric encryption does not protect the ciphertext from tampering. Decryption can fail when an attacker modifies the encrypted key, public key, or message in transit. section 6.2.2
ECIES with an ephemeral key pair
ECIES uses an ephemeral elliptic-curve Diffie–Hellman key pair. The sender performs a key exchange with the recipient’s public key, uses the resulting shared secret with authenticated encryption such as AES-GCM, and sends the ephemeral public key with the ciphertext. The recipient repeats the exchange with the private key and ephemeral public key, then decrypts the ciphertext. section 6.4
Figure 6.9 Building on figure 6.8, (4) after you send both the encrypted symmetric key and the encrypted message to Alice, (5) Alice decrypts the symmetric key using her private key. (6) She then uses the symmetric key to decrypt the encrypted message. (Note that steps 5 and 6 can both fail and return errors if the communications are tampered with by a MITM attacker at step 4.)
Follow the complete recipient flow from transmission through private-key recovery and message decryption, including tampering failures. section 6.2.2
