# Can an U2F public/private key-pair for signatures be used for encryption?

I understand that this might be more a process question:

Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device to generate an encryption key?

I would like to understand if U2F could be used to improve the following scenario:

• I use a single password from the vault to log into a web-site and close the vault again.

How can we improve on this scenario:

• I would like to encrypt each password stored in the vault with a specific encryption key.
• I would like to use a second factor device to make sure that only one password is decrypted at a time when I perform a physical action.
• U2F seems an ideal application for this, since it automates the process of storing individual credentials for individual 'sites', except that it performs signatures but not encryption.

Constraints:

• The public/private key pair is generated inside the U2F device and the private key can not leave the device.
• The device does not support any other operations but the signature operations based on the U2F specification, namely ECDSA.
• The password vault should be treated as an insecure and static, i.e. the user has unlocked the vault and an attacker could see all data in it. The password manager has no means to perform any secret operation, any computation is visible to an attacker.
• Communication between password manager and U2F device can be observed entirely by the attacker.

Pointers:

• The U2F device is meant to assist to decrypt a single encrypted password
• An authentication scheme is not sufficient, since an attacker has access to all encrypted data and could bypass the authentication step if no encryption is involved.
• Only a signature function exists on the U2F device
• The U2F protocol is executed by the password manager as the server, so no external data storage exists. All U2F handle information and the ECDSA public-key are to be stored in the password vault.
• The U2F device generates public/private key-pairs of which the public-key is returned as part of the initial registration. The private key remains securely stored on the U2F device.
• U2F by itself is an authentication protocol, if you have direct access to the primitives required for the protocol things may be possible though. – SEJPM Mar 14 '17 at 20:20
• The question is assuming that I have a U2F device that I could interact with in any way the U2F specification says the device must be capable of. – Christopher Oezbek Mar 14 '17 at 20:23
• Are you asking whether it is possible to use U2F's ECDSA (see here) signature of some piece of data as an encryption key? – mrwhythat Mar 15 '17 at 2:07
• @mrwhythat Yes, that would be the question. Can we design an encryption protocol around such as a signature. – Christopher Oezbek Mar 15 '17 at 19:21
• Yes, usage of the device before an attacker gets hold of the database should not lead to any loss of passwords. Yes, the device would be necessary to enter a new password into the vault (encrypt it). Yes, symmetric encryption would be enough. Sum up: Can we derive a encryption key (any) from an ECDSA scheme? – Christopher Oezbek Mar 19 '17 at 16:01

• I find the conclusion very plausible. However the "thus" lacks mathematical rigor. An hypothetical textbook-RSA-signing-like black box that accepts $m$ with $0<m<N$, and outputs $(r,s)$ with random $r$ ($0<r<N$ and $\gcd(r,N)=1$) and $s=x^d\;r\bmod N$ (perhaps computed as $s=(r^e\;x)^d\bmod N$ internally) generates different signatures for the same message and key, yet can be efficiently turned into a deterministic RSA deciphering device with a little external code. – fgrieu May 29 '17 at 15:57