I want to know how to send a secure message protected with elliptic curve private and public keys.

  • 1
    $\begingroup$ Welcome to crypto.se - a few pointers to help your question be well received and acquire an answer: Questions are expected to demonstrate what you have tried, and where exactly you are stuck. As it is now, there is nothing but a quoted block of text. It looks like a dump of a homework exercise with no effort shown, and it may end up down voted and closed as a result. Please edit your question to include what you have tried so far and specifically what you need help with. $\endgroup$
    – Ella Rose
    Dec 16, 2018 at 1:07
  • 3
    $\begingroup$ If you learned the difference between signing and encryption by now, you might want to edit the question. Also, you should accept the answer that actually helped you achieve the goal, not what you made up of it. The correct answer would actually be: hybrid encryption with ECIES and AES - where the algorithms used are from a proper cryptographic library. Don't implement crypto yourself. Or just use TLS with the cipher suite that suits you. $\endgroup$
    – tylo
    Dec 18, 2018 at 11:31

2 Answers 2


In this case, the private key will be included in the site code and anyone can read it.

No, the private key is not in the "site" code, it is not send. It is just used to authenticate the TLS session, by placing a signature that can be verified with the public key in the X.509 certificate. This certificate has been exchanged before in the handshake and it has been verified & validated in the browser. The private key must be kept private, as the name implies.

How can I send a secret message encoded with a key (key1) and only able to be decoded with another secret key (key2), which I only know it, (using ECDSA).

The ECDSA encryption method cannot be used to encrypt messages to keep them confidential. But it can authenticate the handshake. This handshake establishes the session keys, commonly by performing (EC)DH key agreement using two temporary (ephemeral) key pairs generated both by the client and server. These symmetric session keys can then be used to protect the messages.

If you want to perform encryption with Elliptic Curves then you should have a look at the Elliptic Curve Integrated Encryption Scheme or ECIES.

Minimal description of ECIES

For ECIES the sender generates an message specific EC key pair.

The sender then performs key agreement with the generated private key and the (trusted) public key of the receiver. The sender then uses the resulting key material for normal symmetric encryption. The message specific private key of the sender can be discarded after the symmetric key has been derived; it is just needed to calculate the symmetric key once.

The established symmetric key can be used with any block cipher mode of operation - or indeed with a stream cipher to create the ciphertext. It would of course be a good idea to use authenticated encryption to do this. The message specific public key and ciphertext can be combined and send to the receiver.

The receiver then performs his own key agreement with the receivers static private key and the senders message specific public key. This should derive the same symmetric key, which can finally be used to decrypt the ciphertext.

  • $\begingroup$ Can we presume TLS? Otherwise I'm not sure what protocol you are talking about. $\endgroup$
    – Maarten Bodewes
    Dec 16, 2018 at 1:34
  • 2
    $\begingroup$ Then the problem you are facing is not choice of the algorithm, but key management. There is no way you can trust a public key to encrypt data. And we cannot be expected to explain or compose a full protocol, especially if you don't even know that ECDSA is a signature scheme. When it comes to JS crypto in the browser, you should read pages like these. Use TLS. $\endgroup$
    – Maarten Bodewes
    Dec 16, 2018 at 1:53
  • $\begingroup$ I think you misunderstood him. He did not say "elliptic curve" is for signature only. He mentioned, in fact, that it can be used in protocols for authenticating handshakes and for key agreement. EC is not as flexible as RSA, but it is superior in terms of key size, speed, and (I suspect) security from new mathematical discoveries. So protocols have been designed for EC to do most of the useful things RSA can do. But EC uses key agreement where RSA can be used in a different protocol to establish session keys. $\endgroup$
    – WDS
    Dec 16, 2018 at 4:16
  • $\begingroup$ DSA means Digitial Signature Algorithm. You can encrypt with EC, e.g. ECIES is a hybrid cryptosystem. But you cannot do so with ECDSA. $\endgroup$
    – Maarten Bodewes
    Dec 16, 2018 at 12:26
  • $\begingroup$ Maybe look up an implementation for your favorite runtime and an example? Are you expecting me to fully describe ECIES in an example within the comments? Just try something, and ask on StackOverflow if you're stuck on a specific issue; you can always return with a new question here if you don't understand a specific something of the scheme. $\endgroup$
    – Maarten Bodewes
    Dec 17, 2018 at 9:31

if we have a string message , and want to send this message using secure elliptic curve method (ECIES) , we can do this:

encode our string message to a number (msg) , it can be any big unlimited number

note: suppose G.xy means that G is a point not a number

  • Fixed public variables: (can use it many times and still secure)
    • Choose a private-key k (k is secret Number, receiver only know it)
    • Find any random Generator point G.xy (G.xy is public, everyone can know it)
    • Calculate public-key point K.xy = k * G.xy (K.xy is public, everyone can know it)

  • Sender has to do this:
    • Find any temporary random number r (used only once)
    • Calculate point P1.xy = r * G.xy
    • Calculate point P2.xy = r * K.xy
    • Calculate value P2msg = P2.x + msg (normal add, not curve add)
    • Send values P1.x and P2msg to the receiver

  • Receiver has to do this:
    • From P1.x calc P1.y (no matter if P1.y is + or -)
    • Now We Have P1.xy point and P2msg number
    • Calculate the trick point P2.xy = k * P1.xy , Why?
    • Because: k * (P1.xy) = k * (r * G.xy) = k * G.xy * r = K.xy * r = r * K.xy = P2.xy
    • Calculate number msg = P2msg - P2.x (normal sub not curve sub)

now we know the msg number, then decode it to the original string message


Not the answer you're looking for? Browse other questions tagged or ask your own question.