Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing?

I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, such as EC-DH and EC-Schnorr or even EC-DSA with the same key pair would be interesting too.

• Curve25519 hashes the output of an x-coordinate only Diffie-Hellman key exchange
• Ed25519 is a slight variant of EC-Schnorr signatures.

I saw some recommendations to avoid using a single key for multiple purposes, but I couldn't find anything concrete.

• I suggest that we must solve this question before solve to above question. The question is " Is the using of same curve for encrypt and signature safe?' After solving this must be negotiate about being same keys for encryption and signature. If the response of this question is No then the response of above question is known. It means that the encryption key and signature key can be same or different. If the different is the response, Is it in different curve? crypto.stackexchange.com/questions/91571/… Jun 16, 2021 at 5:56

2 Answers

The paper "On the Joint Security of Encryption and Signature in EMV" shows that ECIES and EC-Schnorr signatures can be used together without compromising security:

In the random oracle model ECIES-KEM and EC-Schnorr are jointly secure if the gap-DLP problem and gap-DH problem are both hard

Ed25519 is extremely similar to EC-Schnorr, and both ECIES and Curve25519 are based on EC-DH, so this gives some indication that using both Curve25519 and Ed25519 with the same key-pair is secure.

Still a proof that directly refers to a keyexchange as used in Curve25519 would be nice.

On a general basis, you want to keep encryption and signature keys disjoint, because they tend to have distinct life cycles. In broad terms, an encryption key should be escrowed, because loss of the private key implies loss of the data which is encrypted relatively to the public key. However, a signature key must not be escrowed, since the proof value of a signature comes from the control of the private key by only the key owner. See this answer for a more detailed discussion.

It may happen that your specific situation may tolerate unescrowed encryption keys -- for instance, your encryption key (which you call "key exchange key") is used only for establishing short-lived session keys, which are not used to encrypt data, or such that the encrypted data is promptly decrypted on the other side, and never stored encrypted. I.e., your key exchange key is used to establish SSL-like tunnels, not to send encrypted e-mails. In that case, the one remaining problem is about interactions between the key exchange algorithm and the signature algorithm: could an attacker break a key exchange by having you emit some signatures which use the same private key ? As @CodesInChaos suggests, it is plausible that using the same private key for ECDH and ECDSA is safe, but the Devil is in the Details: unless there is an explicit security proof with the specific algorithms you are intending to use, I would advise against it.

What you can do, and is safe, is to store a master key K, and dynamically derive you encryption private key and your signature private key from K, with a suitable PRF (e.g. HMAC_DRBG).

• The first distinction is not between encryption and signatures, it's between authentication and confidentiality keys. In particular if you authenticate emails using a key-exchange based algorithm[Which I prefer over signatures], it has the same life cycle as a key used for signing. Jul 22, 2012 at 17:43
• The master key approach doesn't help either, since I try to minimize the size of the public key. I considered using the hash of two separate public keys, but that's annoying in some of my intended uses. After reading the paper I linked, I think the risk of using EC-DH + EC-Schnorr is acceptable compared to the risk of mistakes in other security relevant parts of the protocol and implementation. Jul 22, 2012 at 17:45
• I think the question was more about whether using the same key compromises the security of the key in a cryptographic / mathematical sense. How keys are used and their life cycles is an implementation detail that will vary depending on what kind of system you are trying to build and your security requirements, threat model, use case, etc. May 20, 2019 at 15:29
• I suggest that we must solve this question before solve to above question. The question is " Is the using of same curve for encrypt and signature safe?' After solving this must be negotiate about being same keys for encryption and signature. If the response of this question is No then the response of above question is known. It means that the encryption key and signature key can be same or different. If the different is the response, Is it in different curve? crypto.stackexchange.com/questions/91571/… Jun 16, 2021 at 10:26