# Return to Answer

 3 replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/ edited Apr 13 '17 at 12:48 As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. No, because encryption with a private key and signing with a public key is neither defined nor secure for RSA. For schemes like ECDSA you cannot even directly encrypt. And in the case of RSA I know how that sequence happens. Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too. What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ... No, you should not think of signature verification as decryption, not even for RSA. In RSA, there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation. So it seems that messages encrypted with a user's private key could be decrypted with their public key. Well, yes, but only for textbook RSA, which is completely insecurecompletely insecure. In general, you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key, then the scheme doesn't make any sense. As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. No, because encryption with a private key and signing with a public key is neither defined nor secure for RSA. For schemes like ECDSA you cannot even directly encrypt. And in the case of RSA I know how that sequence happens. Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too. What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ... No, you should not think of signature verification as decryption, not even for RSA. In RSA, there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation. So it seems that messages encrypted with a user's private key could be decrypted with their public key. Well, yes, but only for textbook RSA, which is completely insecure. In general, you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key, then the scheme doesn't make any sense. As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. No, because encryption with a private key and signing with a public key is neither defined nor secure for RSA. For schemes like ECDSA you cannot even directly encrypt. And in the case of RSA I know how that sequence happens. Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too. What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ... No, you should not think of signature verification as decryption, not even for RSA. In RSA, there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation. So it seems that messages encrypted with a user's private key could be decrypted with their public key. Well, yes, but only for textbook RSA, which is completely insecure. In general, you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key, then the scheme doesn't make any sense. 2 edited body edited Oct 3 '15 at 22:45 TildalWave 10.1k88 gold badges4141 silver badges8080 bronze badges As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. No, because encryption with a private key and signing with a public key is not neither defined ornor secure for RSA. For schemes like ECDSA you cannot even directly encrypt. And in the case of RSA I know how that sequence happens. Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too. What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ... No, you should not think of signature verification as decryption, not even for RSA. In RSA, there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation. So it seems that messages encrypted with a user's private key could be decrypted with their public key. Well, yes, but only for textbook RSA, which is completely insecure. In general, you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key, then the scheme doesn't make any sense. As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. No, because encryption with a private key and signing with a public key is not neither defined or secure for RSA. For schemes like ECDSA you cannot even directly encrypt. And in the case of RSA I know how that sequence happens. Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too. What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ... No, you should not think of signature verification as decryption, not even for RSA. In RSA there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation. So it seems that messages encrypted with a user's private key could be decrypted with their public key. Well, yes, but only for textbook RSA, which is completely insecure. In general you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key then the scheme doesn't make any sense. As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. No, because encryption with a private key and signing with a public key is neither defined nor secure for RSA. For schemes like ECDSA you cannot even directly encrypt. And in the case of RSA I know how that sequence happens. Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too. What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ... No, you should not think of signature verification as decryption, not even for RSA. In RSA, there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation. So it seems that messages encrypted with a user's private key could be decrypted with their public key. Well, yes, but only for textbook RSA, which is completely insecure. In general, you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key, then the scheme doesn't make any sense. 1 answered Oct 3 '15 at 21:43 Maarten Bodewes 3,6391212 silver badges2626 bronze badges As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. No, because encryption with a private key and signing with a public key is not neither defined or secure for RSA. For schemes like ECDSA you cannot even directly encrypt. And in the case of RSA I know how that sequence happens. Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too. What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ... No, you should not think of signature verification as decryption, not even for RSA. In RSA there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation. So it seems that messages encrypted with a user's private key could be decrypted with their public key. Well, yes, but only for textbook RSA, which is completely insecure. In general you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key then the scheme doesn't make any sense.