In case I've generated pair of keys (public and private) for RSA, I'm able to use it both for signing and encrypting. Is the same statement true also for pairs of keys based on discrete algorithms?


In general, the answer is no, not necessarily: even if a signature scheme is secure in isolation, and an encryption scheme is secure in isolation, the combination of the two with the same keys may completely wreck security.

For some particular discrete log groups, some particular encryption schemes, and some particular signature schemes, the answer is yes.

  • Degabriele, Lehmann, Paterson, Smart, and Strefler studied the security of combining ECIES with EC-Schnorr (related to the popular EdDSA scheme with the popular Ed25519 instantiation), and of combining ECIES with ECDSA[1].

    The security of EC-Schnorr is reasonably well-understood, while the security of ECDSA is rather complicated and not as well-understood[2] (paywall-free).* The conclusion of Degabriele et al. was that those two combinations provide essentially the same security as their components—i.e., high confidence in ECIES/EC-Schnorr, and not-very-well-understood confidence in ECIES/ECDSA.

  • Signal uses a combination of X25519 and Ed25519 called XEd25519[3]. I'm not aware of a formal security analysis of it, but I expect that the security are quite close to the Degabriele et al. results on ECIES/EC-Schnorr.

However, there is no limit to what can go wrong if you stray outside the bounds of combinations that have been studied. When GnuPG played with the fire of keys reused for Elgamal signature and encryption twenty years ago, they got burned so badly that a single signature leaked the private key[4].

So make sure to ask your cryptographer for advice about the particular encryption scheme and the particular signature scheme want to reuse keys for before you try this at home.

And this is all aside from the qualitatively different security requirements of signing keys and decryption keys in practical terms: if you can revoke a signing key then it doesn't matter if it is later compromised, but a decryption key can never be revoked to prevent retroactive decryption of past messages except by comprehensively erasing it from the universe.

* To be clear, I am not talking about the catastrophic failure of pre-RFC 6979 ECDSA or DSA in the face of a broken random number generator at signing time—a failure mode which Debian and Sony learned about the hard way, and objections to which fell on deaf ears at NIST when the DSA was first proposed in the early '90s[5]. Rather, I am talking about the security of ECDSA even when used exactly as directed.

In fairness, this wasn't exactly because the private key was reused between signing and decryption—rather because the security criteria for private keys in Elgamal encryption and Elgamal signature are different, and optimizing the performance for encryption ruined the security for signature.

Your Answer

