4
$\begingroup$

I need to ask this, as I am not allowed to comment and don't quite understand an existing answer because I don't have a cryptography background and never looked into how ECC works.

  1. Why can't you encrypt a message with a public key generated via ECC?
  2. How can two peers Alice and Bob agree on shared secret (symmetric key), both of which having elliptic-curve-based public-private key pairs?
  3. Could schemes be based on a plain Diffie-Helmann key exchange, where you use the other's public key as authentication (signing messages)?
$\endgroup$

2 Answers 2

9
$\begingroup$
  1. Why can't you encrypt a message with a public key generated via ECC?

Well, for starters, you need to realize that ECC is a collective term for a number of protocols that use elliptic curves to do cryptography. Some of these protocols (ECIES, ECElGamal) are public key encryption methods (that is, they have a public encryption key, and the private decryption key, and the public encryption key allows you to encrypt a message, but not decrypt it); with these, you most certainly can encrypt with the public key. Of course, there are other protocols (ECDH, ECDSA, EdDSA) which do other things, and are not intended to encrypt messages.

  1. How can two peers Alice and Bob agree on shared secret (symmetric key), both of which having elliptic-curve-based public-private key pairs?

Actually, yes, Diffie-Hellman translates nicely to elliptic curves, that version is called ECDH, and is widely used. ECDH works mostly like classical DH (with the minor differences being mostly the validity checking that you need to do on the public shares)

  1. Could schemes be based on a plain Diffie-Helmann key exchange, where you use the other's public key as authentication (signing messages)?

It doesn't make sense to use a public key as 'authentication'; to make sure that the message came from you, you need to stir in something that not everyone knows. This could be a private signature key, or it could be a secret shared between you and the intended recipient. If it's something everyone knows, then everyone can produce that message, and so it wouldn't actually serve as 'authentication'

$\endgroup$
1
  • $\begingroup$ Regarding 3: To rephrase my words, I think I meant using ECDSA keypairs to establish a secure and encrypted channel. DH is prone to MITM, as you don't know who you are talking to. That I meant by authentication. I have your pk (e.g. out of band) and you sign your messages and I sign mine. That way we could create a shared secret (symmetric key) and be sure no third party tampered with it. $\endgroup$
    – Marcellvs
    Jun 11, 2020 at 9:52
1
$\begingroup$
  1. Technically you can. It's theoretically possible to use ElGamal with any elliptic curve group where the decisional Diffie-Hellman assumption holds. An appropriate padding scheme would need to be devised to provide security under chosen ciphertext attack, which is difficult to do correctly. In practice, this would be slow and error-prone, just like RSA encryption is slow and error-prone (partly due to padding), so nobody does it. We use ECIES as described in the answer you linked instead, since it's faster and safer.
  2. They can use Elliptic-Curve Diffie-Hellman. It's also possible to create a key encapsulation mechanism using elliptic curves, as in PSEC-KEM, but we typically want the properties of Diffie-Hellman (speed and ease of creating ephemeral schemes) when we can get them so it's not very commonly done.
  3. Generally it's a bad idea to re-use keys for multiple purposes. Keys should be used for signing xor exchange xor encryption xor encapsulation, never more than one. Instead, derive private keys for different purposes from a single master value using a Key Derivation Function. Failure to do this can lead to leaking your private key, since in some schemes one of the operations is a simple inverse of another.
$\endgroup$
6
  • $\begingroup$ Unfortunately there are many many parts in your answer that I don't understand, because I never heard of them. For example, decisional Diffie-Hellman assumption, key encapsulation, or what ciphertext attacks or padding schemes are. $\endgroup$
    – Marcellvs
    Jun 11, 2020 at 8:29
  • $\begingroup$ I've added links to all the relevant Wikipedia articles. Since these things pretty much all have articles of their own and I was posting from my phone I omitted them, but now that I'm at a desktop they're easy enough to add. $\endgroup$ Jun 12, 2020 at 23:29
  • $\begingroup$ Thank you for adding the links. I learned a few things but still you answers are hard for me to grasp. I still do not understand the answers to 3; i.e. why you can't use each others public key to sign messages in the DH exchange and derive two shared symmetric keys. $\endgroup$
    – Marcellvs
    Jun 13, 2020 at 18:17
  • $\begingroup$ It's not really a problem with DH since DH keys can't be used for signing, but with RSA signing and key encapsulation are opposite operations (with different padding). That means that using the same key pair for signing and encapsulation leaks enough information that an attacker can potentially derive your private key. It's even worse if you don't use correct padding, or try encrypting with no padding, etc. $\endgroup$ Jun 16, 2020 at 15:58
  • $\begingroup$ It feels like we are miscommunicating: I am asking why you would not just use ECC keys to sign messages in DH, since Diffie-Hellman is not secure against active MITM attacks, only passive. That way you could use elliptic curve keys as authentication mechanism to establish a shared secred. $\endgroup$
    – Marcellvs
    Jun 25, 2020 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.