My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key?

I always thought that in order to create a digital signature, you must use your private key and then the receiver uses the sender's public key to verify it. However, on page 4 of this paper, the authors are saying that you can make a signature using the receiver's public key and then the receiver verifies it using his private key (see steps 4 and 5), which to me does not make sense as it does not provide any proof that the sender is who he claims to be.

This is the URL of the paper:


1 Answer 1


Yes, this could be done, but what would the point be? It wouldn't verify anything about the document. A signature (slightly simplified) is just an encryption of a secure hash of a document using one of the keys in the pair. The private key is used to prove that only the private key holder could sign it. In the case of signing with the public key, anyone could alter the document and sign it, so it doesn't prove anything. Not only that, the only person who would be able to verify the "signature" would be the holder of the private key, so there is absolutely no use to it.

Reading the paper, I can't see how they expect the process to work and it appears to be using the term signature in error. What they are likely describing is protecting the session ID as a secure token by use of encrypting with the public key and then decrypting on the server with the private key. The use of the term signature is incorrect and would not provide the necessary security in their use case. The paper isn't very well written and has some other poorly worded sections. I wonder if it may be a poorly translated paper where English wasn't the original language since I see one author is from Taiwan. Though the US co-authors should have proofread it so I wouldn't trust the paper too much.

Update: On further reading I now understand what they are saying in the paper. It is a very poorly worded summary. They are using a system where both the merchant and the purchaser have a key pair. The merchant provides a signed invoice which the client can verify is from the merchant. They then sign their purchase order which includes the invoice which they are ordering. The merchant then verifies that the client signed the purchase request and verifies that their invoice was unaltered. It's rather a bit more convoluted than it seems to need to be, but it is accurate when you take the appropriate instances of public and private keys.

  • Thanks. That's what I thought. It would be much better the other way round, however the paper makes use of the reverse process. The only thing that the digital signature would prove in such a situation is that the data was not tampered.
    – Matthew
    Jul 15, 2013 at 15:52
  • @Matthew incorrect. I could tamper with the document and recalculate the 'signature' because the key used to do so is public. A signature of this kind holds no value.
    – lynks
    Jul 15, 2013 at 15:54
  • Thanks lynks :) You're right. Thank you for your insight.
    – Matthew
    Jul 15, 2013 at 15:56
  • Updated to include analysis about the actual paper. It is hopefully a translation error, otherwise it is a glaring problem in the paper. There are other minor issues with the paper as well that may be translation related (I hope.) Jul 15, 2013 at 15:58
  • Thank you AJ Henderson :) I found it very strange that a published paper had such a serious mistake.
    – Matthew
    Jul 15, 2013 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .