Why are ed25519 keys not recommended for encryption?

Question

Was wondering why there is no straightforward way of using ed25519 keys for encryption.

Then I found this: https://github.com/indutny/elliptic/issues/108

There it is stated that it's unlike RSA not recommendable for this purpose - one should rather derive a Symmetric key from diffie-hellman style shared secret.

It is rather used for signing. But if signing works like this:

hash = doHash(message)
signature = doAsymmetricEncrypt(hash, privateKey)

hash == doAsymmetricDecrypt(signature, publicKey) // true

I would assume it should also work in this direction.

encryptedToken = doAsymmetricEncrypt(token, publicKey)

token = doAsymmetricDecrypt(encryptedToken, privateKey)

My current understanding of the relevant matter boils down to:

• asymmetric cryptography works in both directions: encrypt with private key -> decrypt with public key & encrypt with public key -> decrypt with private key
• ed25519 private key is just a random 256-bit number
• the public key may be unambiguously derived by projecting the private key number over the curve25519
• ed25519 actually means the version as DSA in combination with SHA-512

So I would assume that when I have the 32 bytes for the private key and know that it is exactly such key. I should be able to just use it in any context regardless of using it as signature or encryption algorithm.

Answer 1

You seem confused about a few things. Bear with me, this is a very common confusion!

Encryption is defined with the intent of confidentially transporting information: if you encrypt information, it is meant to be hidden until decrypted by the receiving party. Note that in your pseudo code

hash = doHash(message)
signature = doAsymetricEncrypt(hash, privateKey)

hash == doAsymetricDecrypt(signature, publicKey) //true

... it is impossible to retrieve message from your "ciphertext" signature: you can only retrieve the hash. Secondly, you are encrypting with a private key, and decryption happens with the public key, which means that any party can decrypt your hash, because your publicKey is obviously public.

A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents (wikipedia). Note that this is never defined in terms of encryption. Let me stress this: if you have a teacher that claims that "a signature is an encryption with a private key", they are wrong. If you have a book that claims this, throw it out, burn it -- don't give it away, because it clearly causes confusion -- and get a better book. Encryption is for confidentiality, signatures are for authenticity.

That said: the source of this confusion is in the mathematics of RSA. In RSA (and not in ECC!), the operator for text-book signatures is the same operator as for encryption, with the key material swapped. Note that the mathematical operation is the same thing, not that signatures "are encryption with the key swapped", although they look like they do. Also note that this is for text-book RSA, which is never deployed as-is, but requires padding and randomization that is different between signatures and encryption.

So, while your pseudo-code might or might not work with RSA (depending on the library you use), it will not be secure at all, and will simply not work with ECC because the key material cannot be swapped, because the mathematics behind it simply do not support it.

---

Now, to finally answer your question, encryption with elliptic curves exists, is widely used, and is called ECIES. It indeed boils down to a Diffie-Hellman exchange and using a symmetric algorithm afterwards. There is also ElGamal encryption, if you have very short messages.

It is another question whether it is secure to reuse the same key for ECIES and EdDSA signatures at the same time though.