Is Elliptic Curve Cryptography (ECC) used for key exchanges or encryption?

Question

I understand how ECC works as an alternative to Diffie Hellman key exchange, but is ECC also used to encrypt information? If not, why is the strength to key size ratio of ECC always compared to RSA (which is used to encrypt information not exchange keys)? Thanks!!!

Answer 1

The problem with ECC encryption is the encoding of the messages into points. Look at the Koblits encoding or its variants and you will see that there is a probability that a point will fail to be encoded on the standard embedding and you need a workaround. Also, embedding takes a non-constant time which is not preferable. Even, if you had it, it would be slow compared to block ciphers ( see ElGamal ECC encryption). Cryptographers prefer and advice to use hybrid encryption, that is, key-exchange, KDF, then use a block cipher.

• For key exchange, the ECDH is possible with no post-quantum security. For post-quantum key exchange see the NIST's post-quantum page.

• KDF is necessary for ECDH since the encoding of the points are not uniform.

• AES-256 or ChaCha20 is enough for the encryption since they are post-quantum secure, too.

If not, why is the strength to key size ratio of ECC always compared to RSA (which is used to encrypt information not exchange keys)?

RSA is mostly used for the digital signature, not for encryption ( remember that both needs a special padding scheme to be secure ( like RSA-PSS for signature), and we have the ECDSA and EdDSS for Elliptic curve bases signature. Therefore, one can compare their bit sizes for security ( See keylenght.com) and speeds for digital signature and verification operations.