As I understand it, Digital Signatures
involve the 'signage' of a message using the senders Private Key
, and its validation by the recipient using the sender's mathematically-related Public Key
.
Whilst this seems straight-forward enough, the whole point of Asymmetric encryption (as I understand it) is that the private key is hidden to the world and necessary for decryption, making the publicly available key of the sender therefore useless to the attacker.
If Digital Signatures use the private key of a sender to encrypt data, surely the private key becomes vulnerable, and the message can be attacked using the same decryption attacks commonly used against symmetrically encrypted data.
RSA wouldn't be held in such high regard if it were actually susceptible to the flaw I just outlined, which makes me suspect I have misunderstood something.