Re: Questions about DH and MQVs

<fabrice.gautier@xxxxxxxxx> wrote:
In there an advantage in using ElGamal rather that just directly
derivate the session key from S ?

No. You may want to look up DHIES or ECIES.

I'm also asking that because I also read that ElGamal does not
transcribed well to Elliptic Curves. But I would think that just DH
would (just need to find an appropriate key derivation function).

Nah, ElGamal works just fine with elliptic curves. Any problems you
run into there, you run into with finite fields as well, if you want
security. (The problem is that you need to embed your message in a point
on the curve. But for a finite field (safe prime), you need to embed you
message in a quadratic residue, otherwise you will reveal the Legendre
symbol of your message. Same thing.)

But of course, you never use ElGamal. Again, look at ECIES.

--
Kristian Gjøsteen
.