Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My question is about the difference between signing and encrypting. Why would you still sign something if you are already going to PKI encrypt it?

Doesn't the PKI encryption inherently provide authentication, integrity and non-repudiation?

==added later===

What if I use my private key to encrypt my message. Then anyone can decrypt this message with my public key so it is not private, but all who do, know it is from me because it was decrypted by my public key. Also all know it wasn't tampered with precisely because they could decrypt it

share|improve this question

marked as duplicate by D.W., TildalWave, Xander, Rory Alsop Sep 1 at 8:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

4  
The clarification to Andrey's answer is valuable in interpreting your question; you might want to move it here. –  Mark C. Wallace Aug 29 at 11:18
1  
This is a very basic question. But also an important one. Many mistakes with incorrectly used cryptography are due to people not having asked this particular question. –  kasperd Aug 30 at 12:32
    
BTW, the topic of authenticated encryption (AE) is a quite hot topic, because it was neglected in the past by many implementations. It is especially of a problem, if the encrypted data actually is processed (allowing an attacker to take advantage of bugs in the processor like memory overflow in decompression or executing unwanted commands). –  eckes Aug 31 at 1:17
    
Because you encrypted it with his public key, and anyone can do that, so it doesn't prove you're the message sender. –  Runemoro Aug 31 at 15:48
1  
What research have you done before asking? This seems to be covered by the 2nd answer to security.stackexchange.com/q/2202/971, and by security.stackexchange.com/q/23565/971. –  D.W. Aug 31 at 21:39

4 Answers 4

Encryption provides confidentiality, i.e. ensures that only intended recipient will be able to decrypt the message.

Signing provides authentication, i.e. allows recipient to check that message was sent by a particular sender and wasn't modified.

One way to look at this in the context of PKI is like this: encryption only requires the knowledge of recipient's public key, so anyone can encrypt a message. Signing, on the other hand, requires knowledge of sender's private key, so only the sender can sign the message. As you can see, pure public-key encryption doesn't provide integrity nor authentication.

share|improve this answer
    
That is not exactly the question I have. What if I use my private key to encrypt my message. Then anyone can decrypt this message with my public key so it is not private, but all who do, know it is from me because it was decrypted by my public key. Also all know it wasn't tampered with precisely because they could decrypt it –  Jaap Aug 29 at 10:42
16  
Such hypothetical "encryption with private key" won't be an encryption – it doesn't provide confidentiality (anyone can decrypt the message). In some cryptosystems (e.g. RSA) signing is done by essentially encrypting with a private key, but this can't and shouldn't be generalised on other cryptosystems. –  Andrey Aug 29 at 10:51
5  
That's signing, not encrypting. –  Graham Hill Aug 29 at 10:52
    
@Graham ... ah thanks... I get it :-) The only reason for using "Hash then encrypt" is because a hash if fixed length, shorter than message and universal across binary/plain docs –  Jaap Aug 29 at 10:55
2  
@Jaap Even the PKCS#1 documents, which define the standard way to perform RSA signing or encryption, don't define it as hash then encrypt. It's hash, pad, modular exponentiation. To avoid confusion, they have even given the modular exponentiation a different name (!) for signing and decryption, even though it is the same operation: "RSASP1 and RSAVP1 are the same as RSADP and RSAEP except for the names of their input and output arguments; they are distinguished as they are intended for different purposes" from the RFC –  owlstead Aug 29 at 12:52

Encryption with someones public key provides confidentiality, but doesn't provide authentication or integrity.

In a PKI architecture, you encrypt your message with the public key of the recipient. This proves only that you know their public key, but nothing about yourself. When their public key is indeed public, you could be anyone, including an attacker who intercepted the message (although unable to read it) and replaced it with another message encrypted with the same public key.

But by adding a signature with your own private key (which can then be verified with your public key), you prove your own identity which makes tampering with the message impossible.

Note that this only applies when the public key of the recipient is actually public. When the "public" key is a secret shared only between you and the recipient, a signature becomes indeed redundant.

share|improve this answer

If I left a locked box on your porch in the middle of the night and chained it to your door and dropped a key in the mail slot, it would be secure. Nobody else would be able to get in to it and only you would be able to open it, but you would have no way to know who left it for you. It could have been left by the Publisher's Clearing House prize guy or a terrorist, you simply don't know. Encryption does this, it prevents anyone else from accessing your message, but you have no way to know who it was.

If the Publisher's Clearing House guy instead left the check, signed and sitting in front of your door. You would know that it was from them because they signed it and the check was valid, but anyone could come along and take it because it isn't protected. This is what signing does. It proves that a message came from a particular person, but provides no protection for the contents of the message.

What you really want is a signed package sitting on the door. That way nobody else can tell what it is, but you can verify who it was from and that it hasn't been tampered with.

share|improve this answer

The way I look at it is that if I have an encrypted message which is a series of bytes I can decrypt this with your public key. However any series of bytes is "valid" as a result of your encryption. This means that if somebody modifies the message then I can still decrypt it, I just won't get what you originally encrypted. The person who did the tampering probably won't know what effect their tampering had on the message (unless they had the private key) but they can guarantee they will have changed the message. Sometimes (eg if it is just binary data rather than a text message) then you won't know it has been tampered with because you have nothing to compare it to.

What signing can do is guarantee that the message hasn't been tampered with. You take a hash of the original message and then encrypt that with your private key. Now when I decode the message I can hash it and compare it to the hash that you gave me. If they match then I know that a) the content hasn't been tampered with (because the hashes match) and b) that it is from you because the hash was encrypted by your private key.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.