ECDH-ECDSA Combination

Question

I am doing research on cryptography primitives at a basic level and I faced a question on encryption methods. I understood that ECDH is an approach to for secure key exchange between two parties before the encryption process begins. It is quite useful in symmetric methods that use the same key for encryption and decryption. But I cannot understand the application of key exchange schemes in public-key encryption methods like ECDSA since only public keys are shared between two parties that does not need secure exchange. But such combination (ECDSA/ECDH) seems to happen in protocols like SSL. In what point does exactly secure key exchange methods like ECDH stands in a public key encryption method specifically ECDSA?

Answer 1

ECDH and ECDSA are two different cryptographic primitives. The one isn't build directly upon the other. ECDH and ECDSA both rely on the same computationally hard problem of elliptic curve cryptography of course.

ECDH is a method of performing key agreement. Both parties can establish a secret value by sending only the public key of their ephemeral or static key pair to the other party. If the key pair of one of the parties is trusted by the other party then that key pair may also be used for authentication. This is however not that common. ECDH is the elliptic curve form of the Diffie-Hellman protocol (the DH in the acronym).

ECDSA is, as the name implies, a digital signature algorithm (DSA). It's the elliptic curve form of DSA. It can be used to authenticate the handshake of the TLS protocol. This authentication includes the key agreement parameters used to derive the master secret. The authentication therefore includes the correctness of the session key.

As you can see above, the actual ECDH and ECDSA may be used together in the handshake of the TLS protocol. They are however independent of each other with regards to operation. This is also why ECDH and RSA combinations can exist. ECDH and ECDSA just happen to share the same cryptographic principles.

Answer 2

Your question is not quite not easy to understand, but I'll give an answer to the following interpretation of your question:

How is ECDH used in ECDSA? Or differently formulated: How to build an ECDSA signer and verifier from ECDH?

I'll follow the documentation (and strip) the documentation from Wikipedia here.

First, compute the public key $Q=d_A\times G$. Clearly this is the same as with ECDH where you'd also exchange $Q$ with the other party for later key derivation.

Second, to sign a message, compute $R=k\times G$ (with $k$ chosen uniformly at random and smaller than the group order). Furthermore, cleverly derive $s$ from your private key $d_A$, the ephemeral public key $R_x$, the ephemeral secret key $k$ and the message (hash) $z$.

Lastly, to verify a message, you first cleverly use $R_x$, $z$ and the second signature part $s$ to get $u_1$ and $u_2$ and to calculate $R'=u_1\times G + u_2 \times Q$, where the first summand is a standard "public key generation" and the second is a standard ECDH exchange.

Sadly it is not possible (to my knowledge) to create ECDSA signer solely based on ECDH (say if you have a smartcard supporting ECDH), because $s$ is generated in a way that is not an exponentiation and requires knowledge of $d_A$.

Answer 3

I am not a math guy, but I wonder if the answer you are seeking is this: the purpose of ECDSA is to assure you that you are talking to the right person, and the purpose of ECDH is to let the two of you come up with a shared session key.

Using DH for the later is important for forward secrecy. I.e., even if, later, one or both private keys are stolen by the NSA, the session key cannot be regenerated from the decrypted traffic, since the secret DH parameters are lost for good -- they were never stored or transmitted.