With .NET Framework 4.7 the Elliptic Curve Cryptography (ECC) was greatly enhanced:

The .NET Framework 4.7 has enhanced the functionality available with Elliptic Curve Cryptography (ECC). ImportParameters(ECParameters) methods were added to the ECDsa and ECDiffieHellman classes to allow for an object to represent an already-established key. An ExportParameters(bool) method was also added for exporting the key using explicit curve parameters.

The .NET Framework 4.7 also adds support for additional curves (including the Brainpool curve suite), and has added predefined definitions for ease-of-creation via the new ECDsa.Create(ECCurve) and ECDiffieHellman.Create(ECCurve) factory methods.

I'm a .NET Developer who want use ECC with a HSM, thereby some questions emerge.


  1. It is not allowed to use the same instance of an EC for signing and encryption
    (I read this statement a few times, I'm a developer, not an crypto specialist, so sadly the expertise to understand this in its completeness is missing)


  1. Alice want to send Bob a signed and encrypted message
  2. Alice has Bobs Public Signature Key (brainpoolP320r1)
  3. Bob has Alices Public Signature Key (brainpoolP320r1)
  4. Alice creates a 'throw-away' Key just for encryption but derive a shared secret with Bobs Public Signature Key Is this not a forbidden reuse of keys?
  5. Alice signed the data with the Signature Key before with the transmitting it


  1. Is the derivation of a shared secret between a EC for signing and a 'throw-away' Key a violation of the assumption not to use a key for signing and encryption?
  2. How is it possible to add plausible deniability? (regarding identifying sender and recipient)


With the feedback you provided, I would use this message format to archive plausible deniability and authentication.

enter image description here


2 Answers 2


To ensure only Bob can read the message, the message must be encrypted using Bob's public key. To prove that Alice sent the message, it must be signed with Alice's private key.

I.e. if you are using encryption in the context of a message between two parties, use of seperate keys for encryption and signing is a necessity.

If the order is reversed, and the message is signed before it is encrypted, then the signature is also encrypted and hidden to everyone except Bob.


This seems like a homework assignment so I'll only give some pointers:

Regarding the statement It is not allowed to use the same EC for signing and encryption: Elliptic curves have parameters so there are many of them. Requiring the use of different curves does not make sense, though.

Regarding 1.: Depends on how exactly you sign and encrypt. It's probably fine. You only use the signature key to derive a common secret. That can usually be done in a safe way.

Regarding 2.: Consider that you want signatures to authenticate messages to the other party but you also want plausible deniability. That should give you a good hint.

  • 1) not a student 2) Sorry, I mean same instance of the same Curve Regarding 1) I use the .NET implementation ECDsa.SignData with SHA512 (msdn.microsoft.com/en-us/library/mt591029(v=vs.110).aspx) Regarding 2) I am aware of the contrariety, but if I encrypt the signature it can be archived?
    – hdev
    Apr 11, 2017 at 6:58
  • So you want to use ECDH and ECDSA? And what is this archiving?
    – Elias
    Apr 11, 2017 at 10:51
  • I want to use the same Key for ECDH (for the AES Key) and ECDSA (for authentication). I want to archive, that the unencrypted message doesn't contain any meta data regarding the two parties. But each party owns one HSM with one EC to secure the EC at the best possible way.
    – hdev
    Apr 12, 2017 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .