3 ms·
Wow, I had never considered the conceptual difference between signing and encrypting. In the abstract 'encrypt with the private key' is a totally meaningless s
by rocqua 8y ago
Wow, I had never considered the conceptual difference between signing and encrypting.
In the abstract 'encrypt with the private key' is a totally meaningless sentence for assymetric encryption. The entire point of a public key is decryption not encryption.
I do however believe that textbook RSA signing is secure in the simplest model. It is incredibly malleable but (especially when modeling the hash as a PRF) prevents forged signatures. In that sense I'd equate calling it secure to newtonian mechanics without friction and with perfect elasticity. That is, it forms a simple teaching model, and can inform an intuition on how things work. However, no-one should build things based on the model and expect it to come out correctly.
- dfox 8y agoThe problem is that RSA is somewhat unusual in that it does not really distinquish between public and private keys and the primitive operation is invertible by doing the same thing with the opposite key. That means that encrypt/decrypt/sign in the textbook aproach are essentialy the same primitive operation and verify is trivial extension. For most of other asymetric algorithms the primitive operation is DH-style key agreement function and the derived encryption and signature constructs are significantly more involved and in fact there isn't that much of an symetry between them. (and also the plain asymetric encryption operation gets somewhat pointless)