Why don't digital signatures reveal the senders Private Key

Question

As I understand it, Digital Signatures involve the 'signage' of a message using the senders Private Key, and its validation by the recipient using the sender's mathematically-related Public Key.

Whilst this seems straight-forward enough, the whole point of Asymmetric encryption (as I understand it) is that the private key is hidden to the world and necessary for decryption, making the publicly available key of the sender therefore useless to the attacker.

If Digital Signatures use the private key of a sender to encrypt data, surely the private key becomes vulnerable, and the message can be attacked using the same decryption attacks commonly used against symmetrically encrypted data.

RSA wouldn't be held in such high regard if it were actually susceptible to the flaw I just outlined, which makes me suspect I have misunderstood something.

Answer 1

There seems to be some confusion here about the difference between digitally signing and directed message encryption. If I digitally sign something I indeed need a private key to do so. But you can take my public key and verify that the holder of this public key did indeed sign this .

Where decryption is concerned. Yes a private key is required to decrypt say a message of some sort. However what we do is, before hand, exchange public keys with one another, and I encrypt the message with your public key not mine (or both depending on the algorithm or purpose). That way only the holder of the private key associated with that public key can decrypt it (i.e. you).

To make this a bit more clear they are different ways of using RSA alltogether, basically at a high level:

• Encrypt(plaintext, publicKey) = RSA(OAEP(plaintext), publicKey) = ciphertext
• Decrypt(cipherText, privateKey) = OAEP(RSA(cipherText, privateKey)) = plaintext

While signing is slightly different:

• Sign(plainText, privateKey) = RSA(Hash(plaintext), privateKey) = signature [s]
• Verify(plainText; s; publicKey) = RSA(s,publicKey) = output
• if output == Hash(plainText) the signature is verified

This is crude, but shows the high level difference between them. The private key is never known by either party. But they can still decrypt and verify using their own private keys, and each others public keys.

Answer 2

The whole point of Asymmetric encryption (as I understand it) is that the private-key is hidden to the world and necessary for decryption,

No, that would make it symmetric encryption. The distinguishing characteristic of asymmetric encryption is that you can encrypt something with a public key, but only use the corresponding private key to decrypt it. Or, in the case of RSA, you can switch it, and encrypt something with your private key that can be decrypted with the public key. Contrast that with symmetric encryption, where you can decrypt the ciphertext with the same key as you encrypted it with, which means you cannot have such a thing as a public key, but only a private one.

 If Digital Signatures use the private key of a sender to encrypt data, surely the private key becomes vulnerable, and the message can be attacked using the same decryption attacks commonly used against symmetrically encrypted data.

As mentioned, RSA is "reversible" in that you can encrypt with either the public or private key so that the other one is used to decrypt it.

Encrypting data with your private key does not make that key available to the world, or else it would be an entirely ineffective encryption scheme.