# Why are ed25519 keys not recommended for encryption?

Was wondering why there is no straightforward way of using ed25519 keys for encryption.

Then I found this: https://github.com/indutny/elliptic/issues/108

There it is stated that it's unlike RSA not recommendable for this purpose - one should rather derive a Symmetric key from diffie-hellman style shared secret.

It is rather used for signing. But if signing works like this:

hash = doHash(message)
signature = doAsymetricEncrypt(hash, privateKey)

hash == doAsymetricDecrypt(signature, publicKey) //true


So I would assume it should also work in this direction.

encryptedToken = doAsymetricEncrypt(token, publicKey)

token = doAsymetricDecrypt(encryptedToken, privateKey)


My current understanding of the relevant matter boils down to:

• asymetric cryptography works in both directions: encrypt with private key -> decrypt with public key & encrypt with public key -> decrypt with private key
• ed25519 private key is just a random 256bit number
• the public key may be unambigously derived by projecting the private key number over the curve25519
• ed25519 actually means the version as DSA in combination with sha-512

So I would assume that when I have the 32bytes for the private key and know that it is exactly such key. I should be able to just use it in any context regardless of using it as signature or encryption algorithm.

• There are Q/A answers here that one can encrypt with ECC. However, it will be slow compared to AES. Also, The RSA is the only pure scheme that has both signature and encryption done similar way except for security one needs padding, PSS for signature and OAEP for encryption. – kelalaka Aug 7 '20 at 7:04
• Like this ElGamal with elliptic curves or search this site for elliptic curve encryption – kelalaka Aug 7 '20 at 7:24
• Yhea exactly also found this interesting Post: crypto.stackexchange.com/questions/20561/… – Lenny Aug 7 '20 at 7:51

You seem confused about a few things. Bear with me, this is a very common confusion!

Encryption is defined with the intent of confidentially transporting information: if you encrypt information, it is meant to be hidden until decrypted by the receiving party. Note that in your pseudo code

hash = doHash(message)
signature = doAsymetricEncrypt(hash, privateKey)

hash == doAsymetricDecrypt(signature, publicKey) //true


... it is impossible to retrieve message from your "ciphertext" signature: you can only retrieve the hash. Secondly, you are encrypting with a private key, and decryption happens with the public key, which means that any party can decrypt your hash, because your publicKey is obviously public.

A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents (wikipedia). Note that this is never defined in terms of encryption. Let me stress this: if you have a teacher that claims that "a signature is an encryption with a private key", they are wrong. If you have a book that claims this, throw it out, burn it -- don't give it away, because it clearly causes confusion -- and get a better book. Encryption is for confidentiality, signatures are for authenticity.

That said: the source of this confusion is in the mathematics of RSA. In RSA (and not in ECC!), the operator for text-book signatures is the same operator as for encryption, with the key material swapped. Note that the mathematical operation is the same thing, not that signatures "are encryption with the key swapped", although they look like they do. Also note that this is for text-book RSA, which is never deployed as-is, but requires padding and randomization that is different between signatures and encryption.

So, while your pseudo-code might or might not work with RSA (depending on the library you use), it will not be secure at all, and will simply not work with ECC because the key material cannot be swapped, because the mathematics behind it simply do not support it.

Now, to finally answer your question, encryption with elliptic curves exists, is widely used, and is called ECIES. It indeed boils down to a Diffie-Hellman exchange and using a symmetric algorithm afterwards. There is also ElGamal encryption, if you have very short messages.

It is another question whether it is secure to reuse the same key for ECIES and EdDSA signatures at the same time though.

• Ahh I thought ElGamal is inherent in all public-private key encryption^^ – Lenny Aug 7 '20 at 7:44
• Let me dig deeper a bit into the material - I would then try to make the question and answer more precise to clarify the confusions – Lenny Aug 7 '20 at 7:46
• For now I would ad the confusion in the question about signatures, is not Signature == Encryption. It's rather: Signature includes one encryption step. So this is also not necessarily the case? – Lenny Aug 7 '20 at 7:48
• No, signatures do not include an encryption step. Signatures do not hide anything, they authenticate something. A typical signature in ECC is a Schnorr Signature, and that page does not mention encryption at all. The same for EdDSA, by the way. ElGamal is specifically for discrete log based systems, FYI, so that's practically finite field crypto and ECC. – Ruben De Smet Aug 7 '20 at 8:02
• Could you accept the edited answer or reedit? I think framed it to this would more precises solve the confusion occurring when coming from the angle I came from ;-) – Lenny Aug 15 '20 at 9:56