Generating an Encryption Key Without A Pass Phrase — Meet ECIES

Many encryption systems are compromised because they generate their encryption key using a passphrase, and which can considerably reduce the overall security infrastructure. A passphrase which is taken from a standard dictionary, for example, might reduce the key strength from 256 bits to just 20 bits (for a list of around one million words).

So we often use a key exchange method, such as ECDH (Elliptic Curve Diffie-Hellman) to negotiate a shared key, and where we can then use symmetric key encryption (such as AES or 3DES) to encrypt and decrypt. But we might be worried about a man-in-the-middle attack so we can use an Elliptic Curve Integrated Encryption Scheme (ECIES) to generate a shared key without the need for the Diffie-Hellman exchange.

The method basically starts with Alice created a random key (dA) and then selecting a point on an Elliptic Curve (typically, this is secp256k1), and then determining her public key which is:

QA = dA 𝗑 G

The public key (QA) is then passed to Bob who creates a random number (r) and then calculates R and S:

R = r 𝗑G

S = r 𝗑 QA

The S key is now used with a symmetric key algorithm to encrypt a message. Bob then sends the encrypted message along…