<blockquote>
  <p>Since I'm obtaining the public key from a message, PS2H script, or BIP32 wallet I want to make sure that all secrets (Bitcoins, private keys, and privacy relating to BIP32) are maintained and no risk to privacy exists.</p>
</blockquote>

<p>Though it might have changed in the revisions of BIP0032, in some situations you can put the entire wallet at risk if you expose a single private key. You basically never want that happening, both for privacy and security purposes. </p>

<p>You'll need somebody more in tune with EC like Gregory Maxwell to answer the encryption specific questions, in Bitcoin we only sign and never encrypt so it's something I have never researched deeply. I believe in more recent SSL ciphersuites EC is only used for the key agreement and the rest is handed off to a symmetric cipher for speed purposes. </p>

<p>Remember that Bitcoin addresses are usually not designed to stick around, basing any form of encryption on something that is inherently disposable is probably not a particularly wise idea. The only real use we have for message signing functions is for systems like Eligius which <em>do</em> have a static address already due to their function, and we need to prove that the same user is authorizing a change. </p>

CC BY-SA 3.0
2014-02-18T02:37:15.603Z
2014-02-18T02:37:15.603Z
user13413
<p>Suppose I have a public key for a particular user (perhaps extracted when using the <a href="https://bitcoin.stackexchange.com/a/12556/1878">new public key recovery format</a> included in P2SH, and BIP32 transactions).</p>

<ul>
<li>Is it OK <em>the same key</em> for both signing and encryption?</li>
</ul>

<p>Since I'm obtaining the public key from a message, PS2H script, or BIP32 wallet I want to make sure that all secrets (Bitcoins, private keys, and privacy relating to BIP32) are maintained and no risk to privacy exists.</p>

<ul>
<li>What are some known, safe, (or unsafe) scenarios to use the same key for signing and encryption?</li>
</ul>

CC BY-SA 3.0
2014-02-18T01:41:57.450Z
related: [ECIES encryption compared to RSA](http://digital.csic.es/handle/10261/32671)
makerofthings7
CC BY-SA 3.0
2014-03-25T18:23:28.257Z
related: [Using same keypair for Diffie-Hellman and signing](http://crypto.stackexchange.com/questions/3260/using-same-keypair-for-diffie-hellman-and-signing) on crypto.se.
CodesInChaos
<encryption><public-key><cryptography><deterministic-wallets><bip32-hd-wallets>
ECIES - When is it bad to sign and encrypt using the same keys?
makerofthings7
# ECIES - When is it bad to sign and encrypt using the same keys?

(Asked by: username_0 on 2014-02-18)

Suppose I have a public key for a particular user (perhaps extracted when using the [new public key recovery format](https://bitcoin.stackexchange.com/a/12556/1878) included in P2SH, and BIP32 transactions).

* Is it OK *the same key* for both signing and encryption?

Since I'm obtaining the public key from a message, PS2H script, or BIP32 wallet I want to make sure that all secrets (Bitcoins, private keys, and privacy relating to BIP32) are maintained and no risk to privacy exists.

* What are some known, safe, (or unsafe) scenarios to use the same key for signing and encryption?

**Tags:** encryption, public-key, cryptography, deterministic-wallets, bip32-hd-wallets

> **Comments:**
> **username_0**: related: [ECIES encryption compared to RSA](http://digital.csic.es/handle/10261/32671)  
> **username_1**: related: [Using same keypair for Diffie-Hellman and signing](http://crypto.stackexchange.com/questions/3260/using-same-keypair-for-diffie-hellman-and-signing) on crypto.se.  

---

## 1 answers

### Answer by username_2 on 2014-02-18. Score: 1

> Since I'm obtaining the public key from a message, PS2H script, or BIP32 wallet I want to make sure that all secrets (Bitcoins, private keys, and privacy relating to BIP32) are maintained and no risk to privacy exists.

Though it might have changed in the revisions of BIP0032, in some situations you can put the entire wallet at risk if you expose a single private key. You basically never want that happening, both for privacy and security purposes.

You'll need somebody more in tune with EC like Gregory Maxwell to answer the encryption specific questions, in Bitcoin we only sign and never encrypt so it's something I have never researched deeply. I believe in more recent SSL ciphersuites EC is only used for the key agreement and the rest is handed off to a symmetric cipher for speed purposes.

Remember that Bitcoin addresses are usually not designed to stick around, basing any form of encryption on something that is inherently disposable is probably not a particularly wise idea. The only real use we have for message signing functions is for systems like Eligius which *do* have a static address already due to their function, and we need to prove that the same user is authorizing a change.


---

