ECIES: Purpose of MAC? Assumptions:


$A$ wants to communicate with $B$
$A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$
$A$ knows the address of someone who pretends to be $B$


$A$ wants to send a message to $B$ using ECIES:


$A$ calculates a random private key $K$ and the related public key $P$
$A$ calculates a shared secret $Z$ using $K$ and $P_B$ according to ECIES
$A$ derives symmetric keys from the shared secret $k_1|k_2=\text{KDF}(Z_x)$
$A$ encrypts a message $c=\text{ENCRYPT}_{k_1}(m)$
$A$ tags the encrypted message $t=\text{MAC}_{k_2}(c)$
$A$ sends $P|c|t$ to someone who pretends to be $B$


Questions:


Can $A$ assume, that only $B$ can read the message? I think so.
As $B$ does not know anything about $A$ what is the cryptographic purpose of the MAC? As $K$ and $P$ are message specific anyone who knows $P_B$ could have sent this message with a valid MAC to $B$!?
Does removal of the MAC step reduce ECIES' security? I assume, but I don't get why.
Can $A$ assume that only $B$ can read the message?


Only someone with the private key corresponding to $P_B$ can read the message.  If $A$ can assume that only $B$ has it, that works.


  As $B$ does not know anything about $A$ what is the cryptographic purpose of the MAC?


So that someone else cannot modify the encrypted message.

What we want to prevent is someone can take the encrypted message $E_{P_B}{m}$, and modify it so that it successfully decrypts into a message $m'$, where $m$ and $m'$ are related.  Without the MAC, here is what someone might try:


Take the encrypted text $c = ENCRYPT_{k_1}(m)$
Replace it with a $c'$, that decrypts with $k_1$ into $m'$
Repackage it into $P|c'$ as the new encrypted message.


This is often feasible, because many encryption methods make modifying the encrypted message possible (even if you don't know the encryption key $k_1$).  One example of this is counter mode; if you flip any bit of the encrypted message, and the corresponding bit of the decryption will also flip (with no other change).

Because of this, then without the MAC, Eve might be able to take the encrypted message:

$ENCRYPT( \text{ "Transfer one million into Bob's account, password Rhinosaurus" })$

and change that into

$ENCRYPT( \text{ "Transfer one million into Eve's account, password Rhinosaurus" })$

With the MAC, this type of message modification is infeasible.

So in this case with the MAC Eve can still send "valid" messages to $B$, but as long as Eve does not have the password ("Rhinosaurus") Eve has no way to execute or modify a transaction.