In the Menezes-Vanstone cryptosystem, we have m2, c1, c2 for a NIST-P-256 elliptic curve.
http://asis-ctf.ir/tasks/crypto/crypto_150_165ecb5d4c31280c2ea82c670dfe26e3