A key encapsulation mechanism carries a freshly generated symmetric key to a recipient using public-key cryptography. The recipient recovers that key with a private key, producing shared keying material without exposing it to observers. section 6.2.1
In hybrid encryption, the KEM handles the small secret while a data encapsulation mechanism handles the message:
- Generate a symmetric key, or derive shared secret material through an ephemeral ECDH exchange. section 6.2.1 section 6.4
- Use the symmetric material with authenticated encryption to protect the larger message. section 6.2.2 section 6.4
- Send the encapsulated key or ephemeral public key alongside the ciphertext; the recipient decapsulates or recomputes the secret and decrypts. section 6.2.2 section 6.4
Encrypting a message to Alice
Generate a symmetric key and encrypt the message with it. Encrypt that key with Alice’s public key, then send both ciphertexts. Alice uses her private key to recover the symmetric key and decrypt the message. With ECIES, replace direct public-key encryption of the key with an ephemeral ECDH exchange; tampering can make either decryption step fail. section 6.2.2 section 6.4
Figure 6.9 Building on figure 6.8, (4) after you send both the encrypted symmetric key and the encrypted message to Alice, (5) Alice decrypts the symmetric key using her private key. (6) She then uses the symmetric key to decrypt the encrypted message. (Note that steps 5 and 6 can both fail and return errors if the communications are tampered with by a MITM attacker at step 4.)
Follow the complete hybrid-encryption flow from generating the symmetric key through recipient decryption, including failure under man-in-the-middle tampering. section 6.2.2
