Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Are there any security risks using a single key-pair for both key-exchange and signing?

I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, such as EC-DH and EC-Schnorr or even EC-DSA with the same key pair would be interesting too.

  • Curve25519 hashes the output of an x-coordinate only Diffie-Hellman key exchange
  • Ed25519 is a slight variant of EC-Schnorr signatures.

I saw some recommendations to avoid using a single key for multiple purposes, but I couldn't find anything concrete.

share|improve this question
add comment

2 Answers 2

On a general basis, you want to keep encryption and signature keys disjoint, because they tend to have distinct life cycles. In broad terms, an encryption key should be escrowed, because loss of the private key implies loss of the data which is encrypted relatively to the public key. However, a signature key must not be escrowed, since the proof value of a signature comes from the control of the private key by only the key owner. See this answer for a more detailed discussion.

It may happen that your specific situation may tolerate unescrowed encryption keys -- for instance, your encryption key (which you call "key exchange key") is used only for establishing short-lived session keys, which are not used to encrypt data, or such that the encrypted data is promptly decrypted on the other side, and never stored encrypted. I.e., your key exchange key is used to establish SSL-like tunnels, not to send encrypted e-mails. In that case, the one remaining problem is about interactions between the key exchange algorithm and the signature algorithm: could an attacker break a key exchange by having you emit some signatures which use the same private key ? As @CodesInChaos suggests, it is plausible that using the same private key for ECDH and ECDSA is safe, but the Devil is in the Details: unless there is an explicit security proof with the specific algorithms you are intending to use, I would advise against it.

What you can do, and is safe, is to store a master key K, and dynamically derive you encryption private key and your signature private key from K, with a suitable PRF (e.g. HMAC_DRBG).

share|improve this answer
2  
The first distinction is not between encryption and signatures, it's between authentication and confidentiality keys. In particular if you authenticate emails using a key-exchange based algorithm[Which I prefer over signatures], it has the same life cycle as a key used for signing. –  CodesInChaos Jul 22 '12 at 17:43
    
The master key approach doesn't help either, since I try to minimize the size of the public key. I considered using the hash of two separate public keys, but that's annoying in some of my intended uses. After reading the paper I linked, I think the risk of using EC-DH + EC-Schnorr is acceptable compared to the risk of mistakes in other security relevant parts of the protocol and implementation. –  CodesInChaos Jul 22 '12 at 17:45
add comment

The paper "On the Joint Security of Encryption and Signature in EMV" shows that ECIES and EC-Schnorr signatures can be used together without compromising security:

In the random oracle model ECIES-KEM and EC-Schnorr are jointly secure if the gap-DLP problem and gap-DH problem are both hard

Ed25519 is extremely similar to EC-Schnorr, and both ECIES and Curve25519 are based on EC-DH, so this gives some indication that using both Curve25519 and Ed25519 with the same key-pair is secure.

Still a proof that directly refers to a keyexchange as used in Curve25519 would be nice.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.