4

Suppose there's a transaction in the blockchain in which a given address transfers bitcoins to whoever. I need to encrypt a message so only the owner of that address will read it. I have his public key, but it's a ECDSA key, and as far as I know, ECDSA doesn't support encrypting.

What would be the way to achieve this?

Nathan Parker
  • 257
  • 2
  • 9

1 Answers1

10

You do not encrypt with ECDSA; ECDSA is a signature algorithm.

It so happens that an ECDSA public key really is an "EC public key" and could conceptually be used with an asymmetric encryption algorithm that uses that kind of key; e.g. ECIES; or it could also be used as one half of a key exchange algorithm like ECDH, resulting in a "shared secret" than can then be used with a symmetric encryption algorithm.

However, this is not necessarily a good idea:

  • Using the same key pair for both signing and encryption risks triggering some unwanted interaction between the two algorithms (e.g. the receiving party, upon computing a decryption over an attacker-controlled message, might unwillingly leak information that could lead to a signature forgery). This kind of interaction is not well studied.

  • Signature keys and encryption keys tend to have distinct lifecycles: generation, storage, backup... should not be handled the same way for both kinds of keys. By using the same key for signatures and encryption, you thus do things suboptimally in that regard.

A safer way to do things is to have each party own two key pairs, one for signing and one for encryption. Possibly, the owner signs his encryption public key with his signature key, so that people who know his signature public key may verify the truthfulness of his encryption public key.

Community
  • 1
Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949
  • you can reverse any public key signature scheme to use it for encryption. Is that what ECIES is? – David 天宇 Wong Mar 01 '16 at 19:22
  • No, you cannot reverse any signature scheme to use it for encryption. You can do that for _some_ signature schemes. Actually you can do that only for RSA. Actually you cannot even do that for RSA because there is such a thing as "padding" and if you ignore it you won't get a secure algorithm. In any case, ECIES is not a reversed signature scheme, and there is no known meaningful way in which ECDSA could be "reversed" into an asymmetric encryption scheme. – Thomas Pornin Mar 01 '16 at 19:29
  • @Thomas Pornin: your comment is referred to [there](http://crypto.stackexchange.com/q/44717/555). – fgrieu Mar 19 '17 at 14:58