# Asymmetric public-key cryptography: can either key be used to encrypt or decrypt?

Key exchange describes a public key encrypting plaintext and the private key decrypting, while in digital signatures the reverse is true where the private key is used to encrypt a hash that the companion public key decrypts.

Should I think of asymmetric keys along the lines of one key encrypts and the other decrypts or can either in a pair be used to encrypt or decrypt?

What I’m getting at is, are the public and private key names just logical in that in a key exchange, the public key is shared on an unsecured medium making it “public” yet the private key needs to remain a secret in order to protect the shared key?

I hope this question makes sense and I’ll try to clarify if needed but this the best way I could word it at the moment.

• This is a bit confusing and might be requested to be re-worded. I think you are overlapping some different ideas (Which is fine, you're asking for help!). If this helps: symmetric encryption is just a shared code (at it's simplest). So one comp has it, the other comp has it, the both decrypt and encrypt the same. Asymmetric uses a key exchange to pass the key, but still uses a symmetric ciper (like AES) that get's negotiated. Commented Jan 15, 2019 at 1:34
• Thank you both, this is helpful. Due to the variations in algorithms, it's clear that I can't make some of the generalizations that I thought I was finding. To reword what I was trying to get at is, mathematically are the public and private keys different? Certainly if one encrypts only its companion can decrypt, but can only one encrypt and the other decrypt or, once generated, could either theoretically be chosen to encrypt or decrypt before they are defined by the particular cryptosystem for their role? Commented Jan 15, 2019 at 13:04
• @Daveba123 Example: Sphincs+ is a signature algorithm currently in the competition for post-quantum cryptography. A Sphincs+ public key is a 256-bit (32 byte) hash. A Sphincs+ private key is a 21 kb lookup table / tree structure. Clearly the public key and private key are mathematically different. Commented Jan 15, 2019 at 19:38
• To be clear, the way you have worded your question, you're asking about all asymmetric crypto algorithms as if they are all the same. Over the years, people have invented all sorts of weird crypto algorithms. It sounds like you've read something that says that RSA public keys and private keys are mathematically the same, but you don't actually say that in your question. Commented Jan 15, 2019 at 19:44
• MikeOunsworth makes a great point that these are all different. I'm going to give a very very simple answer that's vaguely not correct but the idea it relates is (dr who style): If the public key was "63" and the rule was the private key had to be able to divide into it and not be "1" or "itself".. then only a private key of "7" or "9" would work. All other private keys would fail. So the public key is mathematics that allows for interacting with the discrete private keys that "fit" it based on rules. Hope that's easier to picture Commented Jan 16, 2019 at 1:36

I think you are mixing terms. Untangling them might help your understanding. (In the order you used them):

Key Exchange is one of a number of methods for taking a symmetric key that you have (say an AES key) and exchanging it with another party such that no eavesdroppers can learn it in the process.

Key exchange and encryption are (almost) unrelated concepts. Key exchange is often accomplished by using asymmetric encryption, but there are key exchange methods that have nothing to do with encryption.

Public key / private key encryption and digital signatures: you are correct in that with encryption, you encrypt for the recipient's public key and then they can decrypt with their private key. With signatures you sign with your private key and then anyone can verify with your public key.

# Are public keys and private keys interchangeable?

Trying to generalize it like you have done gets messy really fast because there are many asymmetric (or "public key") cryptographic algorithms (paraphrased from wikipedia):

Examples of well-regarded asymmetric key encryption and key exchange techniques for varied purposes include:

• Diffie–Hellman key exchange protocol
• ElGamal encryption algorithm
• Elliptic curve Diffie-Hellman key exchange
• Various password-authenticated key agreement techniques
• Paillier cryptosystem
• RSA encryption algorithm (PKCS#1)
• Cramer–Shoup cryptosystem
• YAK authenticated key agreement protocol

Examples of asymmetric key algorithms not widely adopted include:

• NTRUEncrypt cryptosystem
• McEliece cryptosystem

Examples of notable – yet insecure – asymmetric key algorithms include:

• Merkle–Hellman knapsack cryptosystem

There is a similar, but different, list of digital signature algorithms (also from wikipedia):

Some digital signature algorithms

• RSA-based signature schemes, such as RSA-PSS
• DSA and its elliptic curve variant ECDSA
• Edwards-curve Digital Signature Algorithm and its Ed25519 variant.
• ElGamal signature scheme as the predecessor to DSA, and variants Schnorr signature and Pointcheval–Stern signature algorithm
• Rabin signature algorithm
• Pairing-based schemes such as BLS
• Undeniable signatures

You'll notice that RSA and ElGamal are the only algorithms that appears on both lists, ie the same algorithm can be used for both encryption and signatures. I'm personally not familiar with the math behind ElGamal, but RSA signatures work the way you describe - that a hash of the message which can be decrypted by the public key. However that description does not work in general for all crypto algorithms, for example DSA which is for signatures and does not have an encryption variant.

# Summary

To answer your question "Should I think of asymmetric keys along the lines of one key encrypts and the other decrypts or can either in a pair be used to encrypt or decrypt?", the answer is "It depends which algorithm you are talking about."

What you state in your question is (mostly, slightly simplified) true for RSA, but certainly is not true for any other asymmetric encryption or digital signature algorithm. It's better to think of them as four separate cases:

• Encryption public key encrypts
• Encryption private key decrypts
• Signature private key signs
• Signature public key verifies

That's the most specific you can get and still have it apply to all encryption and signature schemes because the details of how the math works varies wildly from one algorithm to the next.

• +1 good answer overall, although for pedantry's sake I should point out that DSA (Digital Signature Algorithm) shows up in both lists. That's because the top list isn't actually a list of ciphers, just a list of public-key cryptosystems, and DSA is public-key based even though it is only for signatures, not encryption (encipherment). The Digital Security Standard is simply the document in which DSA was defined. Also, for any who are wondering: ElGamal shows up in both lists, but ElGamal encryption and signature algorithms are different. Commented Jan 15, 2019 at 9:09
• @CBHacking Thank you very much! Clearly I didn't read those lists carefully enough. Edited. Commented Jan 15, 2019 at 19:28