Suppose there's a transaction in the blockchain in which a given address transfers bitcoins to whoever. I need to encrypt a message so only the owner of that address will read it. I have his public key, but it's a ECDSA key, and as far as I know, ECDSA doesn't support encrypting.

What would be the way to achieve this?

1 Answer 1


You do not encrypt with ECDSA; ECDSA is a signature algorithm.

It so happens that an ECDSA public key really is an "EC public key" and could conceptually be used with an asymmetric encryption algorithm that uses that kind of key; e.g. ECIES; or it could also be used as one half of a key exchange algorithm like ECDH, resulting in a "shared secret" than can then be used with a symmetric encryption algorithm.

However, this is not necessarily a good idea:

  • Using the same key pair for both signing and encryption risks triggering some unwanted interaction between the two algorithms (e.g. the receiving party, upon computing a decryption over an attacker-controlled message, might unwillingly leak information that could lead to a signature forgery). This kind of interaction is not well studied.

  • Signature keys and encryption keys tend to have distinct lifecycles: generation, storage, backup... should not be handled the same way for both kinds of keys. By using the same key for signatures and encryption, you thus do things suboptimally in that regard.

A safer way to do things is to have each party own two key pairs, one for signing and one for encryption. Possibly, the owner signs his encryption public key with his signature key, so that people who know his signature public key may verify the truthfulness of his encryption public key.

  • you can reverse any public key signature scheme to use it for encryption. Is that what ECIES is? Mar 1, 2016 at 19:22
  • 2
    No, you cannot reverse any signature scheme to use it for encryption. You can do that for some signature schemes. Actually you can do that only for RSA. Actually you cannot even do that for RSA because there is such a thing as "padding" and if you ignore it you won't get a secure algorithm. In any case, ECIES is not a reversed signature scheme, and there is no known meaningful way in which ECDSA could be "reversed" into an asymmetric encryption scheme. Mar 1, 2016 at 19:29
  • @Thomas Pornin: your comment is referred to there.
    – fgrieu
    Mar 19, 2017 at 14:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .