Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this despite the sound and explicit prohibition in FIPS 186-4:

ECDSA keys shall only be used for the generation and verification of ECDSA digital signatures.

Do we have an option with an argument that (implementation side channels set aside) it does not jeopardize security of ECDSA, and the encryption is safe under CPA?

Can we achieve this with access to the private key for decryption

  • strictly limited to ECDSA signing (preferred)
  • or is it required a more low-level access to the private key?

Note: I'm meaning ECDSA, if at all possible complete with generation of a true random secret at each signature, no mater how superior Schnorr or/and de-randomized signature is (as used in EdDSA).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.