How do key pairs work especially in the context of cryptographic signatures?

Question

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key assuming the same methods are used (RSA vs DSA vs ECDSA)? If that is the case then a digital signature is just another message regarding the message that was signed (even if it's just a hash of it). As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt. Is it really that simple?

OK, So here is the context. I know that if I want to send an ecrypted and signed message to someone else, that I need to use two keys -- my private key for the signature and the recipient's public key to encrypt the message. And in the case of RSA I know how that sequence happens (with only the symmetric key being encrypted with the recipient's public key). What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key in order to compare digests and verify the signature and thus the message. So it seems that messages encrypted with a user's private key could be decrypted with their public key. I know that messages aren't normally sent that way (the recipient's public key is used) but it seems a message could be encrypted with a private key though I don't know why anyone would do that (stupidly insecure). Am I correct?

Answer 1

As long as matching sets of keys (i.e. the infamous key pair) are used you can use either one to encrypt and the opposite one to decrypt.

No, because encryption with a private key and signing with a public key is neither defined nor secure for RSA. For schemes like ECDSA you cannot even directly encrypt.

And in the case of RSA I know how that sequence happens.

Really? I would say that it is up to the protocol to define how "the sequence" happens. There are discussions about sign-then-encrypt and encrypt-then-sign too.

What seems implied is that the message digest which is encrypted with the sender's private key is then decrypted with the sender's public key ...

No, you should not think of signature verification as decryption, not even for RSA. In RSA, there are different padding schemes. Only "textbook RSA" is similar - in other words, both rely on modular exponentiation.

So it seems that messages encrypted with a user's private key could be decrypted with their public key.

Well, yes, but only for textbook RSA, which is completely insecure.

In general, you should never use the private key to encrypt. Encryption is to keep information confidential, if anyone can decrypt with the public key, then the scheme doesn't make any sense.