How would one "Encrypt" a message using a Bitcoin *public key* and use its private key to decrypt it? I have the following text string:

This is a test message.


Using my bitcoin public key (bitcoin address?), how can I encrypt this message?
How would I decrypt the message using a bitcoin private key?
Yes, this is possible.

However, I want to upfront state that this is not advisable for multiple reasons:


Bitcoin keys are intended to be single use for privacy reasons, and leveraging them for encryption unnecessarily encourages treating them as a long-lived identity.
There may be ugly and dangerous interactions when keys are used for multiple protocols independently.
You're much better off using systems that were actually designed for encryption than trying to piggy-back off Bitcoin's cryptography.
Implementing your own cryptography is very dangerous (in general, unless you know what you're doing, and get plenty of review from experts).


A scheme called ECIES exists that lets you leverage elliptic curve keys to create an encryption system.

In short, it works by:

The sender:


generates an ephemeral private key k using a strong cryptographic random number generator, with associated public key k = kG (multiplication refers to Elliptic Curve multiplication here).
computes an ECDH shared secret s = H(kP), where P is the public key of the recipient.
computes two symmetric keys x1 and x2 using a KDF seeded by s: (x1, x2) = KDF(s).
encrypts the message m using AES, with x1 as the key, to obtain c = AECEncx1(m).
compute a MAC on K and c with x2 as key: h = MACx2(K || c).
sends (K, c, h) to the recipient.


The recipient:


computes the ECDH shared secret, using s = H(pK), where p is his private key.
computes the same two symmetric keys x1 and x2: (x1, x2) = KDF(s).
computes the same MAC h' = MACx2(K || c)
verifies that h' = h, and fails if not.
decrypts the message using s, m' = AESDecx1(c).