I want to know how to send a secure message protected with elliptic curve private and public keys.
closed as unclear what you're asking by Maarten Bodewes♦ Jul 10 at 8:50
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
In this case, the private key will be included in the site code and anyone can read it.
No, the private key is not in the "site" code, it is not send. It is just used to authenticate the TLS session, by placing a signature that can be verified with the public key in the X.509 certificate. This certificate has been exchanged before in the handshake and it has been verified & validated in the browser. The private key must be kept private, as the name implies.
How can I send a secret message encoded with a key (key1) and only able to be decoded with another secret key (key2), which I only know it, (using ECDSA).
The ECDSA encryption method cannot be used to encrypt messages to keep them confidential. But it can authenticate the handshake. This handshake establishes the session keys, commonly by performing (EC)DH key agreement using two temporary (ephemeral) key pairs generated both by the client and server. These symmetric session keys can then be used to protect the messages.
If you want to perform encryption with Elliptic Curves then you should have a look at the Elliptic Curve Integrated Encryption Scheme or ECIES.
Minimal description of ECIES
For ECIES the sender generates an message specific EC key pair.
The sender then performs key agreement with the generated private key and the (trusted) public key of the receiver. The sender then uses the resulting key material for normal symmetric encryption. The message specific private key of the sender can be discarded after the symmetric key has been derived; it is just needed to calculate the symmetric key once.
The established symmetric key can be used with any block cipher mode of operation - or indeed with a stream cipher to create the ciphertext. It would of course be a good idea to use authenticated encryption to do this. The message specific public key and ciphertext can be combined and send to the receiver.
The receiver then performs his own key agreement with the receivers static private key and the senders message specific public key. This should derive the same symmetric key, which can finally be used to decrypt the ciphertext.
if we have a string message , and want to send this message using secure elliptic curve method (ECIES) , we can do this:
encode our string message to a number (msg) , it can be any big unlimited number
note: suppose G.xy means that G is a point not a number
- Fixed public variables: (can use it many times and still secure)
- Choose a private-key k (k is secret Number, receiver only know it)
- Find any random Generator point G.xy (G.xy is public, everyone can know it)
- Calculate public-key point K.xy = k * G.xy (K.xy is public, everyone can know it)
- Sender has to do this:
- Find any temporary random number r (used only once)
- Calculate point P1.xy = r * G.xy
- Calculate point P2.xy = r * K.xy
- Calculate value P2msg = P2.x + msg (normal add, not curve add)
- Send values P1.x and P2msg to the receiver
- Receiver has to do this:
- From P1.x calc P1.y (no matter if P1.y is + or -)
- Now We Have P1.xy point and P2msg number
- Calculate the trick point P2.xy = k * P1.xy , Why?
- Because: k * (P1.xy) = k * (r * G.xy) = k * G.xy * r = K.xy * r = r * K.xy = P2.xy
- Calculate number msg = P2msg - P2.x (normal sub not curve sub)
now we know the msg number, then decode it to the original string message