# Why don't digital signatures reveal the senders Private Key

As I understand it, `Digital Signatures` involve the 'signage' of a message using the senders `Private Key`, and its validation by the recipient using the sender's mathematically-related `Public Key`.

Whilst this seems straight-forward enough, the whole point of Asymmetric encryption (as I understand it) is that the private key is hidden to the world and necessary for decryption, making the publicly available key of the sender therefore useless to the attacker.

If Digital Signatures use the private key of a sender to encrypt data, surely the private key becomes vulnerable, and the message can be attacked using the same decryption attacks commonly used against symmetrically encrypted data.

RSA wouldn't be held in such high regard if it were actually susceptible to the flaw I just outlined, which makes me suspect I have misunderstood something.

• If Digital Signatures use the private key of a sender to encrypt data, surely the private key becomes vulnerable - this assumption is wrong. Encrypting some short text does not make the encryption key vulnerable provided a proper encryption algorithm is used. Jun 18, 2017 at 9:40
• Are you asking specifically about RSA? Different asymmetric algorithms do signing in different ways (some don't support signing at all), and in a sense, RSA is the odd one out here because it is possible in RSA to use the same key pair for encryption/decryption and signing. Note: possible, not necessarily a good idea or actually done.
– user
Jun 18, 2017 at 13:55
• add up all the digits in your phone number and those sums until you get one digit. can i tell your number from that resulting digit? my point is that it's possible to deterministic mix secret data into something verifiable that doesn't leak secrets, much like signing algos mix your key into a message code. Jun 18, 2017 at 20:55
• Yeah dandavis but doing it millions of times probably reveals something about the key? Like having a lot of linear projections onto a random low dimensional space eventually adds up and you can figure out the vector. Nov 28, 2017 at 5:48

There seems to be some confusion here about the difference between digitally signing and directed message encryption. If I digitally sign something I indeed need a private key to do so. But you can take my public key and verify that the holder of this public key did indeed sign this .

Where decryption is concerned. Yes a private key is required to decrypt say a message of some sort. However what we do is, before hand, exchange public keys with one another, and I encrypt the message with your public key not mine (or both depending on the algorithm or purpose). That way only the holder of the private key associated with that public key can decrypt it (i.e. you).

To make this a bit more clear they are different ways of using RSA alltogether, basically at a high level:

• Encrypt(plaintext, publicKey) = RSA(OAEP(plaintext), publicKey) = ciphertext
• Decrypt(cipherText, privateKey) = OAEP(RSA(cipherText, privateKey)) = plaintext

While signing is slightly different:

• Sign(plainText, privateKey) = RSA(Hash(plaintext), privateKey) = signature [s]
• Verify(plainText; s; publicKey) = RSA(s,publicKey) = output
• if output == Hash(plainText) the signature is verified

This is crude, but shows the high level difference between them. The private key is never known by either party. But they can still decrypt and verify using their own private keys, and each others public keys.

The whole point of Asymmetric encryption (as I understand it) is that the private-key is hidden to the world and necessary for decryption,

No, that would make it symmetric encryption. The distinguishing characteristic of asymmetric encryption is that you can encrypt something with a public key, but only use the corresponding private key to decrypt it. Or, in the case of RSA, you can switch it, and encrypt something with your private key that can be decrypted with the public key. Contrast that with symmetric encryption, where you can decrypt the ciphertext with the same key as you encrypted it with, which means you cannot have such a thing as a public key, but only a private one.

If Digital Signatures use the private key of a sender to encrypt data, surely the private key becomes vulnerable, and the message can be attacked using the same decryption attacks commonly used against symmetrically encrypted data.

As mentioned, RSA is "reversible" in that you can encrypt with either the public or private key so that the other one is used to decrypt it.

Encrypting data with your private key does not make that key available to the world, or else it would be an entirely ineffective encryption scheme.