# Can elliptic curve cryptography encrypt with public key and decrypt with private key like RSA?

I know that RSA can be used for both, encryption and signature. What about EC? I know about ECDSA/EdDSA, but to my knowledge it can only be used to sign. I also know about ECDH, but it is a key agreement protocol. Is there some elliptic curve based public key encryption algorithm?

• ECDH + symmetric encryption gives you public key encryption. What is your definition of public key encryption if that does not count? – otus Mar 26 '17 at 6:02
• Is (EC)DH secure if it's not ephemeral (that is, the same public key is a lot of other public keys to generate a lot of shared secret, instead of be changed for every generation? – Eric Mar 26 '17 at 10:42
• Yes, non-ephemeral Diffie–Hellman is secure – fixed DH is an alternative in TLS though not used much. (It lacks forward secrecy but then so does RSA encryption.) – otus Mar 26 '17 at 20:08

Yes, there is a elliptic curve based public key encryption
Let $a$ be A's private key and $\alpha=aG$ be his public key. B who wants to send an encrypted message to A, does the following :

1. B chooses a random number $r$, $1\leq r\leq n-1$ and computes $rG$
2. B then computes $M+r\alpha$. Here the message $M$ (a binary string) has been represented as a point in $\langle G\rangle$
3. B sends the encrypted text pair $\langle rG,M+r\alpha\rangle$ to A

On receiving this encrypted text A decrypts in the following manner

1. A extracts $rG$ and computes $a\cdot(rG)=r\cdot(aG)=r\alpha$
2. A extracts the second part of the pair $M+r\alpha$ and subtracts out $r\alpha$ to obtain $M+r\alpha-r\alpha=M$

There is a drawback in this as block of plaintext has to be converted to a point before being encrypted, denoted by $M$ above. After the decryption it has to be re-converted to plain text.

• For the uninitiated: The first scheme is generalized ElGamal. – SEJPM Mar 26 '17 at 10:42

You can lookup ECIES which is the Integrated Encryption Scheme used with Elliptic Curve cryptography.

It it's based on DH calculations. This means that it requires a symmetric cipher. Basically you must use a hybrid cryptosystem. So it cannot directly encrypt plaintext as possible in RSA-PKCS#1 v1.5 or OAEP. It also means that it has some overhead (which is largely negated by the small key size, of course).

Basically IES turns any DH problem into an encryption scheme. You would still need to choose the key derivation function, cipher and mode of encryption. To my knowledge there isn't such a thing as fully standardized IES.