# Using (EC)DH to generate a signature

Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection.

There is a party B want to use this system to create a signature over some data. This signature can then be used to prove to a party C that A created the signature over the data. Party C of has access to the trusted public key belonging to the key pair of A.

Rules:

• there is one static public / private key pair for A
• no other operations are allowed on the private key of A
• party B need to supply a public key to A to perform (EC)DH, but this may in fact be any data
• the public key offered by B to system A does get validated according to the (EC)DH scheme used
• any signature scheme is acceptable, as long as the signature can be verified by party C
• the secret key is generated using a KDF over the generated shared secret

Is it possible to generate a signature over data with this kind of system? If not, can you offer some kind of prove that it is not possible? If so, what would such a signature scheme look like?

If it is not possible, what if the key derivation part was left out and the shared secret could be used for any operation?

• Well, if ‘performing ECDH’ means ‘computing scalar multiplication on a curve given an arbitrary base point and an arbitrary scalar’, and you also have access to a secret scalar, then it's relatively easy, but that's kind of vacuous. Can't quite do Ed25519 using X25519 because X25519 doesn't distinguish sign, but you can do something close in a quotient modulo sign—qDSA. – Squeamish Ossifrage Oct 17 at 22:02
• qDSA seems to require a hash over part of the private key (?) Additional operations with the private key are of course forbidden as well (heck you could just perform ECDSA if that wasn't the case). – Maarten Bodewes Oct 17 at 22:10
• If you all you have is $[n]B$ and an oracle for $P \mapsto H([n]P)$, where $n$ is the secret scalar and $B$ is the standard base point, then there's almost certainly no signature scheme you can derive from that. Probably same even if the oracle is $P \mapsto [n]P$. – Squeamish Ossifrage Oct 17 at 22:28