Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It only takes a minute to sign up.
Sign up to join this community
I came across this in the source code for ECKey.java:
"Represents an elliptic curve public and (optionally) private key, usable for digital signatures but not encryption."
Why can you not encrypt with it? It would be useful to be able to do that, for instance you could write a message to someone that only they can read. Is it a fundamental problem or simply a matter of man hours to implement it? (I'm happy to write it if it's possible.)
Here is the quote you're referring to (link)
/**
* <p>Represents an elliptic curve public and (optionally) private key, usable for digital signatures but not encryption.
* Creating a new ECKey with the empty constructor will generate a new random keypair. Other constructors can be used
* when you already have the public or private parts. If you create a key with only the public part, you can check
* signatures but not create them.</p>
*
* <p>ECKey also provides access to Bitcoin-Qt compatible text message signing, as accessible via the UI or JSON-RPC.
* This is slightly different to signing raw bytes - if you want to sign your own data and it won't be exposed as
* text to people, you don't want to use this. If in doubt, ask on the mailing list.</p>
*
* <p>The ECDSA algorithm supports <i>key recovery</i> in which a signature plus a couple of discriminator bits can
* be reversed to find the public key used to calculate it. This can be convenient when you have a message and a
* signature and want to find out who signed it, rather than requiring the user to provide the expected identity.</p>
*/
This library implements ECDSA is Elliptic Curve Digital Signature Algorithm, hence you can only sign/verify with this algorithm. ECDH is Elliptic Curve Diffie Hellman and can be used to share a secret key between two parties.
ECIES is Integrated Encryption Scheme which mix EC and AES, but it is not implemented in OpenSSL (the core Bitcoin crypto library) nor the one you reference.
More details on these algorithms on wikipedia ;)
In conclusion, with ECDSA you can only sign/verify, you may encrypt mixing ECDH to generate keys and AES to do symmetric encryption (even at command line: look at ecparam, ecdh, enc), or you may use ECIES but you need a different library.
On a related note, this guy seems to have re-invented ElGamal encryption using ECDSA but I haven't looked into his code at all.
As far as I know, the only issue is the different encoding schemes for ECDSA and ECC. It might take some effort to get thru the specs to determine what byte sequences mean what, but in general if it is difficult to derive the private key from the public key, then you can use the key-pair for either signatures or encryption. If one system is insecure, the other is.
