Was wondering why there is no straightforward way of using ed25519 keys for encryption.

Then I found this: https://github.com/indutny/elliptic/issues/108

There it is stated that it's unlike RSA not recommendable for this purpose - one should rather derive a Symmetric key from diffie-hellman style shared secret.

It is rather used for signing. But if signing works like this:

hash = doHash(message)
signature = doAsymmetricEncrypt(hash, privateKey)

hash == doAsymmetricDecrypt(signature, publicKey) // true

I would assume it should also work in this direction.

encryptedToken = doAsymmetricEncrypt(token, publicKey)

token = doAsymmetricDecrypt(encryptedToken, privateKey)

My current understanding of the relevant matter boils down to:

  • asymmetric cryptography works in both directions: encrypt with private key -> decrypt with public key & encrypt with public key -> decrypt with private key
  • ed25519 private key is just a random 256-bit number
  • the public key may be unambiguously derived by projecting the private key number over the curve25519
  • ed25519 actually means the version as DSA in combination with SHA-512

So I would assume that when I have the 32 bytes for the private key and know that it is exactly such key. I should be able to just use it in any context regardless of using it as signature or encryption algorithm.

  • 1
    $\begingroup$ There are Q/A answers here that one can encrypt with ECC. However, it will be slow compared to AES. Also, The RSA is the only pure scheme that has both signature and encryption done similar way except for security one needs padding, PSS for signature and OAEP for encryption. $\endgroup$
    – kelalaka
    Aug 7, 2020 at 7:04
  • $\begingroup$ Like this ElGamal with elliptic curves or search this site for elliptic curve encryption $\endgroup$
    – kelalaka
    Aug 7, 2020 at 7:24
  • $\begingroup$ Yhea exactly also found this interesting Post: crypto.stackexchange.com/questions/20561/… $\endgroup$
    – Lenny
    Aug 7, 2020 at 7:51

1 Answer 1


You seem confused about a few things. Bear with me, this is a very common confusion!

Encryption is defined with the intent of confidentially transporting information: if you encrypt information, it is meant to be hidden until decrypted by the receiving party. Note that in your pseudo code

hash = doHash(message)
signature = doAsymetricEncrypt(hash, privateKey)

hash == doAsymetricDecrypt(signature, publicKey) //true

... it is impossible to retrieve message from your "ciphertext" signature: you can only retrieve the hash. Secondly, you are encrypting with a private key, and decryption happens with the public key, which means that any party can decrypt your hash, because your publicKey is obviously public.

A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents (wikipedia). Note that this is never defined in terms of encryption. Let me stress this: if you have a teacher that claims that "a signature is an encryption with a private key", they are wrong. If you have a book that claims this, throw it out, burn it -- don't give it away, because it clearly causes confusion -- and get a better book. Encryption is for confidentiality, signatures are for authenticity.

That said: the source of this confusion is in the mathematics of RSA. In RSA (and not in ECC!), the operator for text-book signatures is the same operator as for encryption, with the key material swapped. Note that the mathematical operation is the same thing, not that signatures "are encryption with the key swapped", although they look like they do. Also note that this is for text-book RSA, which is never deployed as-is, but requires padding and randomization that is different between signatures and encryption.

So, while your pseudo-code might or might not work with RSA (depending on the library you use), it will not be secure at all, and will simply not work with ECC because the key material cannot be swapped, because the mathematics behind it simply do not support it.

Now, to finally answer your question, encryption with elliptic curves exists, is widely used, and is called ECIES. It indeed boils down to a Diffie-Hellman exchange and using a symmetric algorithm afterwards. There is also ElGamal encryption, if you have very short messages.

It is another question whether it is secure to reuse the same key for ECIES and EdDSA signatures at the same time though.

  • $\begingroup$ Ahh I thought ElGamal is inherent in all public-private key encryption^^ $\endgroup$
    – Lenny
    Aug 7, 2020 at 7:44
  • $\begingroup$ For now I would ad the confusion in the question about signatures, is not Signature == Encryption. It's rather: Signature includes one encryption step. So this is also not necessarily the case? $\endgroup$
    – Lenny
    Aug 7, 2020 at 7:48
  • 3
    $\begingroup$ No, signatures do not include an encryption step. Signatures do not hide anything, they authenticate something. A typical signature in ECC is a Schnorr Signature, and that page does not mention encryption at all. The same for EdDSA, by the way. ElGamal is specifically for discrete log based systems, FYI, so that's practically finite field crypto and ECC. $\endgroup$ Aug 7, 2020 at 8:02
  • $\begingroup$ Yhea because I added exactly those things which were missing for me to understand the difference. Maybe we could completely restructure the answer^^... Because the short answer is: Well it is not not recommended - it just works differently and there is some obvious confusions. Then dive into the confusions up to the explanations of what really is the difference. To the solution how you would use ECC in ElGamal like style to do the encryption. ;-) $\endgroup$
    – Lenny
    Aug 15, 2020 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.