Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
ECDSA keys are much shorter than RSA keys, but typically only used for signing, not encryption.
Is there an accepted way of doing this?
(https://bitcointalk.org/index.php?topic=196378.0 deliberately says don't use it.)
Note: I'm only looking at encrypting tens of bytes of data, so no AES suggestions please.
The ECDSA algorithm can't be used for encryption. It's not that there's no accepted way to do it, it's that it's simply not possible to do so. Likewise, RSA signing can't be used to encrypt (there's a mandatory hash in signing that you don't want in encryption). However, RSA signatures work similarly to RSA encryption; they aren't interchangeable, but fundamentally RSA signing, verification, encryption, and decryption all revolve around running the RSA operation on some data $m$ with one of the exponents $e$ (i.e. computing $m^e\pmod{n}$). You could, by making some not-huge changes to RSA signing, get an encryption scheme.
In contrast, ECDSA looks fairly different from any encryption algorithm. Verification looks nothing like signing, and the private key and public key are different things (one's a point, one's a number), so with the public key you can't do anything that looks like signing. A change to let you encrypt wouldn't be called ECDSA, as it wouldn't particularly resemble it.
(There are ECC signing and encryption schemes both called ElGamal; ECDSA is based on ElGamal signing. However, they just share a name because that's the guy who invented both of them; they don't look particularly similar, aside from both relying on discrete logarithm. RSA encryption and signing might also have had different names if they weren't invented by the same people.)
So ECDSA simply can't be used for encryption -- it looks fundamentally different from encryption schemes. What the person on that site did was create an encryption scheme unrelated to ECDSA (but rather similar to ElGamal encryption) that happens to use the same key format. ECDSA keys, ECDH keys, ECIES keys without shared secrets, ElGamal encryption keys, ElGamal signing keys, and the keys of most other ECC systems I'm aware of look rather similar: there's a set of curve parameters (which are generally the same for everyone), and then the private key is an integer $k$ and the public key is $k$ times the generator point found in the curve parameters. This is the standard keypair for something relying on discrete logarithms; with DH and DSA, the keypair is also basically that (just replace $k\times G$ with $g^k$). In that sense, there are all sorts of ways to use ECDSA-style keys for encryption; ECIES is probably your best bet.
That said, ECDSA keys should not be directly reused as encryption keys. Using the same key for two schemes generally a bad idea (they aren't designed for that, and may interact insecurely), and there are often differences in key management between encryption and signing. However, the general structure is already used in plenty of encryption systems.
