5
$\begingroup$

Is it possible to use ECDH key pairs (Public and private keys) for encryption and decryption like RSA key pairs in encryption and decryption. Say for example, if i have RSA key pairs then i could do below things,

// Encryption
this.cipher.init(Cipher.ENCRYPT_MODE, this.publicKey);
hexEncodedCipher = this.cipher.doFinal(value);

// Decryption
this.cipher.init(Cipher.DECRYPT_MODE, this.privateKey);
hexEncodedCipher = this.cipher.doFinal(value);

So Is it possible to do the same thing for ECDH ? And is it correct way of doing things ?

$\endgroup$
  • $\begingroup$ ECDH is not an encryption scheme (it's a key agreement protocol), therefore you can not simply use it's key (which refers in key exchange/agreement protocols to one party fixing her input and publishing the public value) for encryption - there is some gap which has to be covered. The word key is not only used in the context of encryption, e.g. a signature algorithm also has two keys and in general can not be used as an encryption scheme. $\endgroup$ – tylo Mar 1 '17 at 13:47
3
$\begingroup$

Yes. You can for instance use ECIES. As there is no encryption counterpart for ECDSA (for digital signatures) it is however based on ECDH (Diffie-Hellman key agreement). This also means that it is required to send a public key together with the ciphertext.

Basically ECIES performs key agreement in an offline fashion and then encrypts the message with the resulting secret key. This in turn means that a symmetric cipher (stream cipher, authenticated cipher or just a block cipher + mode of operation) is required. It could also mean additional overhead as the public key of the encrypting party needs to be send with the ciphertext.

Using an asymmetric primitive together with a symmetric primitive such as a block cipher or hash is called a hybrid cryptosystem.


Notes:

  • The sender and receiver need to configure / accept a common set of domain parameters - this are commonly parameters of a named curve.
  • There is also a DH counterpart called IES, ECDH is based on DH and ECIES is based on IES.
  • By default many implementations do not offer integrity or authenticity protection and may - in the worst case - be susceptible to plaintext / padding oracle attacks. You may want to use a signature and/or authenticated encryption instead of e.g. ECB or CBC mode encryption.
  • ElGamal encryption may also be used (as SEJPM notes in his comment) although this may leave you with specifying more of the underlying protocol.
$\endgroup$
  • 1
    $\begingroup$ For the uninitiated: You can basically run any crypto that can be abstracted to groups where the discrete logarithm is hard on elliptic curves. This includes ElGamal which may be useful because of its homomorphic property. $\endgroup$ – SEJPM Mar 1 '17 at 10:07
  • $\begingroup$ @SEJPM Added to answer, including proper attribution of course, thanks. $\endgroup$ – Maarten Bodewes Mar 1 '17 at 12:42
  • $\begingroup$ Note: ECIES nor ElGamal are part of the standard Java RE by Oracle as far as I know; you may either implement them yourself or use Bouncy Castle. If I'm not mistaken Bouncy uses CBC mode for ECIES, so you may want to just base your code on Bouncy instead of using/copying it verbatim. $\endgroup$ – Maarten Bodewes Mar 1 '17 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.