# How to encrypt using private key for ECC

As we know, ECC using $$C_2 = r \cdot G, C_1 = M + r \cdot G$$; and decrypt with $$M=C_1 - K \cdot C_2$$. And sign using point $$X$$: $$X = k \cdot G(x_0,y_0)$$. $$r = x_0 \cdot K; s = 1 / k \cdot (M + r \cdot d) \mod(n)$$; here $$d$$ is private key, $$K$$ is public key. and then verify by is true of $$r \cdot G == M \cdot G / s + x \cdot K/s$$.

Here is my question: can I encrypt using private key (or sign) and get the message $$M$$ directly by public key $$K$$? Instead of $$r \cdot G == M \cdot G / s + x \cdot K/s$$, how can I got something like $$M = \operatorname{function}(r,s,K,G)$$ ?

Thanks Edward

• Actually, the standard method to encrypt using ECC is ECIES. Standard methods to sign using ECC include ECDSA and EC-Schnorr.
– fgrieu
Jul 11, 2021 at 8:47
• Err, why do you want to encrypt with your private key. Since your public key is public implies the encrypted message can decrypt by everybody. What is your actual problem? Also, private key is integer and public key is a point! Jul 11, 2021 at 17:40
• I try to replace RSA with ECC in a very small project. If ECC can't do that, I may still use RSA to do that message recovery. Jul 13, 2021 at 6:24
• If you cannot live with the 64 byte overhead of ECC (assuming 256 bit key size) then I would recommend sticking with RSA, although it is less strong in the classical sense and that signatures giving message recovery are generally not state-of-the-art like PSS. Jul 26, 2021 at 13:57