Why does ECC not have an encrypt capability in GPG, but RSA does?

Question

I'm attempting to establish a process for setting up a new GPG identity for myself and my threat model.

Much of it is following guides which I believe are still considered best practices:

• https://github.com/drduh/YubiKey-Guide

• https://blogs.itemis.com/en/openpgp-on-the-job-part-4-generating-keys

• https://dev.to/benjaminblack/signing-git-commits-with-modern-encryption-1koh

These schemes seem to be advocating for:

1. Setup an offline primary key that only has the "Certify" capability
2. Create an online subkey with capabilities: "Sign"
3. Create an online subkey with capabilities: "Authenticate"
4. Create an online subkey with capabilities: "Encrypt"

The above guides are using RSA-4096, but based on my other readings it seems like using ECC with curve 25519 is as secure, but requires less space to store and less energy to use, so I'd like to go with that.

I was playing with the tools in a temporary GNUPGHOME, and I was able to setup an ECC primary key, but when I sent to generate the "encrypt" subkey, I noticed there didn't seem to be an encryption capability:

Possible actions for a ECDSA/EdDSA key: Sign Certify Authenticate 
Current allowed actions: Sign Certify 

   (S) Toggle the sign capability
   (A) Toggle the authenticate capability
   (Q) Finished

But if I use RSA, it seems like it is an option:

Possible actions for a RSA key: Sign Certify Encrypt Authenticate 
Current allowed actions: Sign Certify Encrypt 

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

I wasn't able to find much online about why this is.

For reference my gpg version information is as follows:

gpg (GnuPG) 2.2.20
libgcrypt 1.8.7

Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

In summary, my question is:

• Why does RSA have an "encrypt" capability but ECC doesn't.
• Is having one primary key and 3 subkeys for each functionality still best practice?
• Should I generate an RSA subkey with an "encrypt" capability as a workaround?

Answer 1

When you generate key, first you need to generate sign-only primary key. While RSA allows encryption and signing for the same key (i.e. it can have encrypting primary key), for ECC there are different key algorithms for ECC:

• sign-only ECDSA
• sign-only EdDSA
• encrypt-only ECDH

Once primary key is generated, you would be able to add encrypting and signing subkey(s) via gpg --edit-key command.

This message may give more details on how to add subkeys in batch mode: https://lists.gnupg.org/pipermail/gnupg-users/2014-September/050839.html