Dual_EC_DRBG has the property that if $Q = e\cdot P$, someone who knows $e$ can break the PRNG.
This seems to lead to a public-key stream cipher:
- Alice chooses a random $P, e$, where $P$ is a generator.
- Alice computes $Q = e\cdot P$.
- Alice publishes $(P, Q)$ as her public key. She retains $(P, e)$ as her secret key.
To send a message:
- Bob chooses a random seed $S$.
- Bob publishes the first $n$ bits of the output.
- Bob uses the rest of the output as a keystream.
To decrypt, Alice uses her knowledge of $e$ to break "PRNG" and recover the keystream.
Is this system secure? Does it provide any advantage over other forms of asymmetric cryptography?