# Can elliptic curve cryptography encrypt with public key and decrypt with private key like RSA?

I know that RSA can be used for both, encryption and signature. What about EC? I know about ECDSA/EdDSA, but to my knowledge it can only be used to sign. I also know about ECDH, but it is a key agreement protocol. Is there some elliptic curve based public key encryption algorithm?

• ECDH + symmetric encryption gives you public key encryption. What is your definition of public key encryption if that does not count?
– otus
Commented Mar 26, 2017 at 6:02
• Is (EC)DH secure if it's not ephemeral (that is, the same public key is a lot of other public keys to generate a lot of shared secret, instead of be changed for every generation?
– Eric
Commented Mar 26, 2017 at 10:42
• Yes, non-ephemeral Diffie–Hellman is secure – fixed DH is an alternative in TLS though not used much. (It lacks forward secrecy but then so does RSA encryption.)
– otus
Commented Mar 26, 2017 at 20:08

Yes, there is an elliptic curve-based public key encryption
Let $$a$$ be Alice's private key and $$P=[a]G$$ be her public key. Bob, who wants to send an encrypted message to Alice, does the following :

1. Bob chooses a random number $$r$$, $$1\leq r\leq n-1$$ and computes $$[r]G$$
2. Bob then computes $$M+[r]P$$. Here the message $$M$$ (a binary string) has been represented as a point in $$\langle G\rangle$$
3. Bob sends the encrypted text pair $$\langle [r]G,M+[r]P\rangle$$ to Alice

On receiving this encrypted text Alice decrypts in the following manner

1. Alice extracts $$[r]G$$ and computes $$a\cdot([r]G)=r\cdot([a]G)=[r]P$$
2. Alice extracts the second part of the pair $$M+[r]P$$ and subtracts out $$[r]P$$ to obtain $$M+[r]P-[r]P=M$$

There is a drawback in this as a block of plaintext has to be converted to a point before being encrypted, denoted by $$M$$ above. After the decryption, it has to be reconverted to plain text.

Note: $$[r]P$$ is the scalar multiplication i.e. add $$P$$ itself $$r$$-times.

• For the uninitiated: The first scheme is generalized ElGamal. Commented Mar 26, 2017 at 10:42
• Note that this scheme has a drawback: the encoding of the message into points, see Koblitz Encoding or look into Elligator1/2 Commented Dec 29, 2021 at 16:52

You can lookup ECIES which is the Integrated Encryption Scheme used with Elliptic Curve cryptography.

It it's based on DH calculations. This means that it requires a symmetric cipher. Basically you must use a hybrid cryptosystem. So it cannot directly encrypt plaintext as possible in RSA-PKCS#1 v1.5 or OAEP. It also means that it has some overhead (which is largely negated by the small key size, of course).

Basically IES turns any DH problem into an encryption scheme. You would still need to choose the key derivation function, cipher and mode of encryption. To my knowledge there isn't such a thing as fully standardized IES.