How to encrypt with elliptic curve cryptography (ECC)?

Question

I need to ask this, as I am not allowed to comment and don't quite understand an existing answer because I don't have a cryptography background and never looked into how ECC works.

1. Why can't you encrypt a message with a public key generated via ECC?
2. How can two peers Alice and Bob agree on shared secret (symmetric key), both of which having elliptic-curve-based public-private key pairs?
3. Could schemes be based on a plain Diffie-Helmann key exchange, where you use the other's public key as authentication (signing messages)?

Answer 1

1. Why can't you encrypt a message with a public key generated via ECC?

Well, for starters, you need to realize that ECC is a collective term for a number of protocols that use elliptic curves to do cryptography. Some of these protocols (ECIES, ECElGamal) are public key encryption methods (that is, they have a public encryption key, and the private decryption key, and the public encryption key allows you to encrypt a message, but not decrypt it); with these, you most certainly can encrypt with the public key. Of course, there are other protocols (ECDH, ECDSA, EdDSA) which do other things, and are not intended to encrypt messages.

2. How can two peers Alice and Bob agree on shared secret (symmetric key), both of which having elliptic-curve-based public-private key pairs?

Actually, yes, Diffie-Hellman translates nicely to elliptic curves, that version is called ECDH, and is widely used. ECDH works mostly like classical DH (with the minor differences being mostly the validity checking that you need to do on the public shares)

3. Could schemes be based on a plain Diffie-Helmann key exchange, where you use the other's public key as authentication (signing messages)?

It doesn't make sense to use a public key as 'authentication'; to make sure that the message came from you, you need to stir in something that not everyone knows. This could be a private signature key, or it could be a secret shared between you and the intended recipient. If it's something everyone knows, then everyone can produce that message, and so it wouldn't actually serve as 'authentication'

Answer 2

1. Technically you can. It's theoretically possible to use ElGamal with any elliptic curve group where the decisional Diffie-Hellman assumption holds. An appropriate padding scheme would need to be devised to provide security under chosen ciphertext attack, which is difficult to do correctly. In practice, this would be slow and error-prone, just like RSA encryption is slow and error-prone (partly due to padding), so nobody does it. We use ECIES as described in the answer you linked instead, since it's faster and safer.
2. They can use Elliptic-Curve Diffie-Hellman. It's also possible to create a key encapsulation mechanism using elliptic curves, as in PSEC-KEM, but we typically want the properties of Diffie-Hellman (speed and ease of creating ephemeral schemes) when we can get them so it's not very commonly done.
3. Generally it's a bad idea to re-use keys for multiple purposes. Keys should be used for signing xor exchange xor encryption xor encapsulation, never more than one. Instead, derive private keys for different purposes from a single master value using a Key Derivation Function. Failure to do this can lead to leaking your private key, since in some schemes one of the operations is a simple inverse of another.