Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this despite the sound and explicit prohibition in FIPS 186-4:

ECDSA keys shall only be used for the generation and verification of ECDSA digital signatures.

Do we have an option with an argument that (implementation side channels set aside) it does not jeopardize security of ECDSA, and the encryption is safe under CPA?

Can we achieve this with access to the private key for decryption

  • strictly limited to ECDSA signing (preferred)
  • or is it required a more low-level access to the private key?

Note: I'm meaning ECDSA, if at all possible complete with generation of a true random secret at each signature, no mater how superior Schnorr or/and de-randomized signature is (as used in EdDSA).

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.