Digital Signature and man-in-the-middle

Question

While reading this page about Public-Private key encryption, I asked myself a question about digital signature:

Alice wants to sign a message for Bob; she uses her private key to sign the message. Bob receives it and uses Alice's public key to generate the signature and checks that it's the same as the one that Alice attached to the message.

If I'm a pirate, I can intercept Alice message, and use Alice's public key to generate the signature too, no? If I'm right, it means that I can change Alice message, uses Alice's public key to generate the new signature and send this one to Bob, instead of the original one, no ?

There must be something wrong in this logic, but I don't see where...

Answer 1

Bob does not "generate" the signature with Alice's public key. Signature generation requires the private key. What Bob does is verifying the signature; verification needs only the public key.

Indeed, the public key can safely be made public precisely because knowing the public key is not sufficient to generate signatures.

(You may have been confused by some explanation about how a signature is "encryption with the private key". This is a very widespread but also flawed and confusing explanation, that is best ignored.)

Answer 2

There's a bit of confusion.

• Alice encrypts message with Bob's public key
• Alice signs the message with her private key (only she has).
• Bob checks the signature with Alice's public key.
• Bob is able to decrypt the message with his private key (only he has).

In this way, you know that Alice sent the message because only she has her private key.

Now if somehow Alice's private key is exposed to or derived by Eve. Then Eve can now sign messages as if she's Alice, and Bob won't know the difference.

Answer 3

If I'm a pirate, I can intercept Alice message, and use Alice's public key to generate the signature too, no?

Basically you can use any random sequence of bits and feed them to the RSA encryption algorithm as a key and it will give you some output. To be meaningful, the encryption and the decryption key must have the mathematical relation that RSA defines:

The pirate can use Alice's public key to sign/encrypt a message. However, the signature derived will be much different from the one generated with the private key.

Verifying a digital signature takes three steps:

1. Decrypt the signature => yields hash code
2. Produce own hash code of the message
3. Compare the two hashes

Thus, when Bob starts to decrypt what the pirate encrypted with the public key, he will never ever end up with the valid hash code of the message and the authentication fails.