# What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this despite the sound and explicit prohibition in FIPS 186-4:

ECDSA keys shall only be used for the generation and verification of ECDSA digital signatures.

Do we have an option with an argument that (implementation side channels set aside) it does not jeopardize security of ECDSA, and the encryption is safe under CPA?

Can we achieve this with access to the private key for decryption

• strictly limited to ECDSA signing (preferred)
• or is it required a more low-level access to the private key?

Note: I'm meaning ECDSA, if at all possible complete with generation of a true random secret at each signature, no mater how superior Schnorr or/and de-randomized signature is (as used in EdDSA).

• @Squeamish Ossifrage: I'm ignorant about VRF; had to search that! But I'm a tad pessimistic given that I want to use a standard curve (added that requirement).
– fgrieu
May 12 '18 at 16:01
• On reflection it seems unlikely that an adversary can do much from learning $H([n]P)$ for attacker-chosen points $P$, where $n$ is the secret signing key and $H$ is an independent random oracle from whatever one you use in your ECDSA signature scheme. May 12 '18 at 16:04
• If your encryption provides an ECDH oracle in some way, then security of your private key is diminuished. I remember only darkly but it was by a generic group argument and the security strength will be reduced by a factor of 1/3.
– user27950
May 13 '18 at 8:16
• @Cryptostase Is that when you provide a $P \mapsto [n]P$ oracle, or a $P \mapsto H([n]P)$ oracle? May 14 '18 at 13:42