ECCS: Elliptic Curve Cryptography Cramer Shoup
How to convert Cramer-Shoup into ECC?


Because Cramer-Shoup restricts itself to using only group operations (and never using a single value as both a scalar and a group member), it can translate directly into elliptic curve group operations.  What you quoted are the operations listed in multiplicative form, and so:


When the protocol says to select a cyclic group $G$ of order $q$, you'd pick an elliptic curve, with $q$ being the order of the large prime subgroup.
When the protocol specifies $g^x$, this is the point multiplication of $g$ times the scalar $x$, that is, what is more typically written as $x \cdot g = \underbrace{g+g+...+g}_{x\text{ times}}$
When the protocol specifies $gh$, this is point addition of $g$ and $h$, which is more typically written as $g+h$
When the protocol specifies $g/h$, this is point subtraction of $g$ and $h$, which is more typically written as $g-h$


For example, the original has $c = g_1^{x_1} g_2^{x_2}$; this would be understood as (written in additive notation) $c = x_1\cdot g_1 + x_2 \cdot g_2$.  That is, you perform the point multiplication of the scalar $x_1$ with the point $g_1$, and you perform the point multiplication of $x_2$ with the point $g_2$, and then you add the two resulting points.

The hardest part would be the conversion of $m$ into an elliptic curve point.  Of course, you can avoid the issue entirely if you're doing hybrid crypto (just pick a valid point $m$ randomly, and then use $KDF(m)$ as the transmitted symmetric key).  If that doesn't work for your scenario, one alternative method is to encode the value $m$ into some of the bits of the $x$ coordinate, and they try random settings of the remaining bits until you get a valid $x$ coordinate (e.g. if you're using a Weierstrass curve with $p&gt;3$, then $x^3 + ax + b$ is a quadratic residue); then, select the $y$ coordinate from the two possibilities randomly.


  How do I prove the security of ECC Cramer-Shoup?


The proof in the original Cramer-Shoup paper assumed that the Decisional Diffie-Hellman problem was hard in the group; as long as you select a curve where that is also hard (pairing friendly curves are not an option), the original proof would apply.