In both RSA and usual¹ Elliptic Curve Cryptography (ECC), there is a public key and a private key, forming a matching pair. In signature, the private key is used for signature generation, and the matching public key is used for signature verification. In (usually, [hybrid][1]) encryption, the public key is used for encryption, and the matching private key is used for decryption. This dual _role_ with exchange of _usage order_ of the public and private key applies to RSA and ECC alike. In RSA, it is additionally mathematically possible to exchange the _values_ of the public and private exponents $e$ and $d$. It is thus possible to exchange the _values_ of the public and private keys when expressed as pairs of integers $(N,e)$ and $(N,d)$. Such exchange of values is almost never done in RSA practice². Such exchange of values is not possible in ECC. That's because an ECC private key is an integer $d$ in $[0,n)$ where $n$ is the [order][2] of the generator $G$ of the Elliptic Curve, and the public key is $Q=dG=\underbrace{G+G\cdots+G}_{d\text{ times}}$ where $+$ is the point addition operation of the Elliptic Curve group. The private and public keys are different mathematical objects, which values can't be meaningfully exchanged. ___ > With ECC, given the private key, it is possible to deduce (calculate) the corresponding public key, unlike RSA. **Yes,** under appropriate hypothesis: having the RSA private key in a non-standard format, and an unusually large public exponent. In ECC, given the Elliptic Curve group³ and the private key $d$, it is a basic operation to find the public key: just compute $Q\gets dG$. In RSA, when given the private key, it is not always possible to compute the matching public key. Specifically, when the private key is given in the form $(N,d)$, and the public exponent $e$ of the public key $(N,e)$ is a large random secret, finding $e$ is hard. However, finding $e$ is trivial when it is part of the private key, e.g. because the private key is in the standard form $(N,e,d,p,q,d_p,d_q,q_\text{inv})$ (the recommended [RSA private-key format in PKCS#1v2][3], a de-facto standard). And finding $e$ is easy when $e$ is below some threshold, e.g. $e<2^{256}$, which also is usual. ___ ¹ As codified e.g. by [SEC1][4]. ² Such exchange is insecure if one of the public/private exponents $e$ and $d$ is less than $2^{256}$, which is common for performance reasons. Exchanging public and private key is secure only if the first chosen among public/private exponents $e$ and $d$ is selected at random in a much larger set, or if both are secret, negating the benefits of public-key cryptography. ³ Usually a public parameter, e.g. `secp256k1` for anything Bitcoin. Common ECC groups are codified in [SEC2][5]. [1]: https://en.wikipedia.org/wiki/Hybrid_cryptosystem [2]: https://en.wikipedia.org/wiki/Order_(group_theory) [3]: https://tools.ietf.org/html/rfc2437#section-11.1.2 [4]: https://www.secg.org/sec1-v2.pdf [5]: https://www.secg.org/sec2-v2.pdf