If A encrpyts the message and creates signature using his private key and sends through the network then only B with the public key of A can decrypt that message.

But what if the attacker gets access to the public key of A and the encrypted message through the network? Will he be able to decrypt the message?

  • 2
    When signing, A uses their own private key so anyone can verify the signature. When encrypting, A uses B's public key so only B can decrypt. Furthermore: a public key is assumed to be accessible by everyone, attackers included. – Marc May 18 at 11:26

Signature and encryption are entirely separate things although they use similar technologies to accomplish their goals.

Signature is used to verify the identity of sender. If attacker has access to A's private key, he could create fake messages that appear to originate from A.

Encryption is used to scramble a message so that only receiver can read it. Typically the sender A would use the public key of the receiver B to encrypt a message, not the other way around as your question suggests. The message is encrypted using the public key of B, and decrypted using the private key which only B has access to.

This way both encryption and signing can be safely accomplished even if attacker has both A's and B's public keys. They are called public keys because they can be safely given out, shared and published, and only private keys need to be protected.

Your question implies public and private keys are used incorrectly (wrong "direction), which might be possible in some weird system, but it wouldn't be secure, and the attacker would indeed be able to read the messages.

Done properly, the sender A would sign the message using his own private key, and encrypt the message using B's public key. Receiver B would then verify the identity of the sender using A's public key, and decrypt the message using his own private key.

| improve this answer | |
  • Thanks alot! It waved away all my misconceptions. – user13315994 May 18 at 12:15

But what if the attacker gets access to the public key of A and the encrypted message through the network? Will he be able to decrypt the message?

No. The public key is public. It is meant to be public. It's meant to be on the signature of the email, broadcasted to everyone, posted on forums, printed on billboards.

That's how PKI (public key infrastructure) encryption works. You get someone's public key, encrypt something, and only the owner of the corresponding private key can decrypt. Unless someone steals the private key, having the public key and the encrypted message will not have the private message.

Signing uses the same principle: getting the signature and the public key will not disclose the private key, but you need the message in clear to be able to verify the signature.

You may be talking about encryption, not signing. Encryption means the message is hidden, signing means the message is authentic.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.