With ECDSA signature anyone can be sure if I own the private key or not without revealing it...

But if I have a website, and the users want to send me a secret message with this website using the normal internet explorer. In this case, the private key will be included in the site code and anyone can read it.

How can I send a secret message encoded with a key (key1) and only able to be decoded with another secret key (key2), which I only know it, (using ECDSA or any other method).

Or how to encode-decode a message using elliptic curve without using public or private keys.

  • 1
    $\begingroup$ Welcome to crypto.se - a few pointers to help your question be well received and acquire an answer: Questions are expected to demonstrate what you have tried, and where exactly you are stuck. As it is now, there is nothing but a quoted block of text. It looks like a dump of a homework exercise with no effort shown, and it may end up down voted and closed as a result. Please edit your question to include what you have tried so far and specifically what you need help with. $\endgroup$ – Ella Rose Dec 16 '18 at 1:07
  • 2
    $\begingroup$ If you learned the difference between signing and encryption by now, you might want to edit the question. Also, you should accept the answer that actually helped you achieve the goal, not what you made up of it. The correct answer would actually be: hybrid encryption with ECIES and AES - where the algorithms used are from a proper cryptographic library. Don't implement crypto yourself. Or just use TLS with the cipher suite that suits you. $\endgroup$ – tylo Dec 18 '18 at 11:31

In this case, the private key will be included in the site code and anyone can read it.

No, the private key is not in the "site" code, it is not send. It is just used to authenticate the TLS session, by placing a signature that can be verified with the public key in the X.509 certificate. This certificate has been exchanged before in the handshake and it has been verified & validated in the browser. The private key must be kept private, as the name implies.

How can I send a secret message encoded with a key (key1) and only able to be decoded with another secret key (key2), which I only know it, (using ECDSA).

The ECDSA encryption method cannot be used to encrypt messages to keep them confidential. But it can authenticate the handshake. This handshake establishes the session keys, commonly by performing (EC)DH key agreement using two temporary (ephemeral) key pairs generated both by the client and server. These symmetric session keys can then be used to protect the messages.

If you want to perform encryption with Elliptic Curves then you should have a look at the Elliptic Curve Integrated Encryption Scheme or ECIES.

Minimal description of ECIES

For ECIES the sender generates an message specific EC key pair.

The sender then performs key agreement with the generated private key and the (trusted) public key of the receiver. The sender then uses the resulting key material for normal symmetric encryption. The message specific private key of the sender can be discarded after the symmetric key has been derived; it is just needed to calculate the symmetric key once.

The established symmetric key can be used with any block cipher mode of operation - or indeed with a stream cipher to create the ciphertext. It would of course be a good idea to use authenticated encryption to do this. The message specific public key and ciphertext can be combined and send to the receiver.

The receiver then performs his own key agreement with the receivers static private key and the senders message specific public key. This should derive the same symmetric key, which can finally be used to decrypt the ciphertext.

  • $\begingroup$ Can we presume TLS? Otherwise I'm not sure what protocol you are talking about. $\endgroup$ – Maarten Bodewes Dec 16 '18 at 1:34
  • 2
    $\begingroup$ Then the problem you are facing is not choice of the algorithm, but key management. There is no way you can trust a public key to encrypt data. And we cannot be expected to explain or compose a full protocol, especially if you don't even know that ECDSA is a signature scheme. When it comes to JS crypto in the browser, you should read pages like these. Use TLS. $\endgroup$ – Maarten Bodewes Dec 16 '18 at 1:53
  • $\begingroup$ I think you misunderstood him. He did not say "elliptic curve" is for signature only. He mentioned, in fact, that it can be used in protocols for authenticating handshakes and for key agreement. EC is not as flexible as RSA, but it is superior in terms of key size, speed, and (I suspect) security from new mathematical discoveries. So protocols have been designed for EC to do most of the useful things RSA can do. But EC uses key agreement where RSA can be used in a different protocol to establish session keys. $\endgroup$ – WDS Dec 16 '18 at 4:16
  • $\begingroup$ DSA means Digitial Signature Algorithm. You can encrypt with EC, e.g. ECIES is a hybrid cryptosystem. But you cannot do so with ECDSA. $\endgroup$ – Maarten Bodewes Dec 16 '18 at 12:26
  • $\begingroup$ It's called encryption & decryption. Read up on ECIES, little point to try and explain it here in the comments. $\endgroup$ – Maarten Bodewes Dec 17 '18 at 2:58

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.