Can Pohlig-Hellman encryption be done over elliptic curves? Following a bunch of questions on the topic of Pohlig-Hellman encryption. I was wondering if this could be trivially adapted to be done over elliptic curves just like we create EC-DH instead of DH.
surprisingly  my google searches came up with no references for this, or in fact any symmetric encryption based on elliptic curves. 
It seems to me elliptic curves should provide the same properties of Pohlig-Hellman but allow same security with smaller keys.
I was wondering if this could be trivially adapted to be done over elliptic curves


If you don't mind the plaintexts being confined to points on the curve (as opposed to elements of $\mathbb{Z}^*_p$), then it's easy; pick a key $k$ that's relatively prime to the curve order $q$ (easy to do if you pick a curve with prime order), and then:

$$\begin{align}
Enc_k(P) &amp;= kP\\
Dec_k(P) &amp;= (k^{-1} \bmod q)P
\end{align}$$

Now, if you can't live with that restriction, one obvious possibility would be to use a curve with "twist security" (e.g. Curve25519), and so if the curve order is $q$, and the twist order is $q_T$ (note: $q$ and $q_T$ are the order of the curves, not the prime subgroups), then,

$$\begin{align}
Enc_k(P) &amp;= kP\\
Dec_k(P) &amp;= (k^{-1} \bmod q)P&amp;&amp;\text{if P is on the curve}\\
Dec_k(P) &amp;= (k^{-1} \bmod q_T)P&amp;&amp;\text{if P is on the twist}
\end{align}$$

Curve25519 point multiplication can be done only using the $x$ coordinate, and so we can treat arbitrary values between 0 and $2^{255}-19$ as points.

Now, this construction preserves some of the properties of PH (for example, $$Enc_a(Enc_b(M)) = Enc_b(Enc_a(M))$$
but not others, for example, the question that was recently asked about combining two keys into a third that had $Dec_c(Enc_b(Enc_a(M))) = M$; that doesn't work as well; we can't define a $c$ that'll be able to decrypt both messages on the curve and messages on the twist (and giving someone both would allow them to potentially recover the values $a, b$)