2

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key assuming the same methods are used (RSA vs DSA vs ECDSA)? If that is the case then a digital signature is just another message regarding the message that was signed (even if it's just a hash of it). As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. Is it really that simple?

OK, So here is the context. I know that if I want to send an ecrypted and signed message to someone else, that I need to use two keys -- my private key for the signature and the recipient's public key to encrypt the message. And in the case of RSA I know how that sequence happens (with only the symmetric key being encrypted with the recipient's public key). What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key in order to compare digests and verify the signature and thus the message. So it seems that messages encrypted with a user's private key could be decrypted with their public key. I know that messages aren't normally sent that way (the recipient's public key is used) but it seems a message could be encrypted with a private key though I don't know why anyone would do that (stupidly insecure). Am I correct?

  • Only for some schemes. That does apply to RSA, but for ECDSA the signature that was computed will actually instead derive the public key when combined with the plaintext, rather than resulting in the plaintext when combining the public key and signature. For Lamport signatures, signing is the only capability it has. – Natanael Oct 3 '15 at 18:14
2

As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt.

No, because encryption with a private key and signing with a public key is neither defined nor secure for RSA. For schemes like ECDSA you cannot even directly encrypt.

And in the case of RSA I know how that sequence happens.

Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too.

What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ...

No, you should not think of signature verification as decryption, not even for RSA. In RSA, there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation.

So it seems that messages encrypted with a user's private key could be decrypted with their public key.

Well, yes, but only for textbook RSA, which is completely insecure.

In general, you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key, then the scheme doesn't make any sense.

  • Right, I know that what I proposed is insecure. I'm just trying to wrap my head around the fact the private key is used to sign and the public key to verify and that looks like encryption/decryption to me. You said there are different padding schemes. What are those and why are they different? – Cyberis Oct 4 '15 at 0:34
  • 1
    Probably best to read PKCS#1; when unsure, read the standard. – Maarten Bodewes Oct 4 '15 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.