ECC How to exchange signed and encrypted data

Question

With .NET Framework 4.7 the Elliptic Curve Cryptography (ECC) was greatly enhanced:

The .NET Framework 4.7 has enhanced the functionality available with Elliptic Curve Cryptography (ECC). ImportParameters(ECParameters) methods were added to the ECDsa and ECDiffieHellman classes to allow for an object to represent an already-established key. An ExportParameters(bool) method was also added for exporting the key using explicit curve parameters.

The .NET Framework 4.7 also adds support for additional curves (including the Brainpool curve suite), and has added predefined definitions for ease-of-creation via the new ECDsa.Create(ECCurve) and ECDiffieHellman.Create(ECCurve) factory methods.

I'm a .NET Developer who want use ECC with a HSM, thereby some questions emerge.

Assumption

1. It is not allowed to use the same instance of an EC for signing and encryption
   (I read this statement a few times, I'm a developer, not an crypto specialist, so sadly the expertise to understand this in its completeness is missing)

Problem

1. Alice want to send Bob a signed and encrypted message
2. Alice has Bobs Public Signature Key (brainpoolP320r1)
3. Bob has Alices Public Signature Key (brainpoolP320r1)
4. Alice creates a 'throw-away' Key just for encryption but derive a shared secret with Bobs Public Signature Key Is this not a forbidden reuse of keys?
5. Alice signed the data with the Signature Key before with the transmitting it

Question

1. Is the derivation of a shared secret between a EC for signing and a 'throw-away' Key a violation of the assumption not to use a key for signing and encryption?
2. How is it possible to add plausible deniability? (regarding identifying sender and recipient)

Update

With the feedback you provided, I would use this message format to archive plausible deniability and authentication.

Answer 1

To ensure only Bob can read the message, the message must be encrypted using Bob's public key. To prove that Alice sent the message, it must be signed with Alice's private key.

I.e. if you are using encryption in the context of a message between two parties, use of seperate keys for encryption and signing is a necessity.

If the order is reversed, and the message is signed before it is encrypted, then the signature is also encrypted and hidden to everyone except Bob.

Answer 2

This seems like a homework assignment so I'll only give some pointers:

Regarding the statement It is not allowed to use the same EC for signing and encryption: Elliptic curves have parameters so there are many of them. Requiring the use of different curves does not make sense, though.

Regarding 1.: Depends on how exactly you sign and encrypt. It's probably fine. You only use the signature key to derive a common secret. That can usually be done in a safe way.

Regarding 2.: Consider that you want signatures to authenticate messages to the other party but you also want plausible deniability. That should give you a good hint.