Using the same RSA keypair to sign and encrypt

The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys.

Is it safe to use the same RSA keypair both for encryption / decryption and for signing / verification?

-
Depends on tricky details of the padding scheme you use and your implementation. It'd generally discouraged to reuse keys like that. –  CodesInChaos Dec 3 '13 at 9:42
Encrypting with the private key has little sense since everyone knowing the public key can snoop into the message. Usually the other party public key is used to encrypt, as explained in en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Encryption. –  daniel Dec 3 '13 at 17:18
If you use the same structure for signing and encrypting, then Bob can send you a hash as a ciphertext for you to decrypt with your private key, you're signing it thus, and then asking for the resulting plaintext as autentication so retrieving a valid signature. –  daniel Dec 3 '13 at 17:34

Short Answer: NO, it is not safe, do NOT do this.

Longer Answer: You are true that you can use your RSA keypair for both operations. This approach is used in many applications and scenarios. There are Web Services or Single Sign-On implementations, which enforce you to use the same key pair for both operations. X.509 certificates do not allow you (by default) to determine, if a given RSA key must be used for encryption/decryption or for signing/verification. It is possible to enforce this only with specific extensions or certificate fields, which are not mandatory...

However, in cryptography it is in general a very bad practice to use the same key for two operations. For example, if one of the operations gets compromized, it can break security properties of the other operations where the same key is used.

There is one practical example in the RSA key setting. Imagine a server which decrypts ciphertexts and signs messages with an RSA key. Imagine this server is vulnerable to a specific chosen-ciphertext attack (Bleichenbacher's attack), which allows an adversary to decrypt arbitrary ciphertexts without knowing server's private key. If the server uses the same RSA key pair for encryption/decryption and signing/verification, using this attack the adversary is also able to create arbitrary server signatures. This would not be possible if the server would use distinct RSA key pairs for these operations.

Please see our paper for more details: http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/ Section 4 discusses the problem of key reuse in public key setting. Section 5.3 shows practical examples of these attacks and their impact. Sections 5.4 and 5.5 discuss countermeasures and their application by different vendors.

-
The Bleichenbacher example is a bad one — the key isn't used safely for encryption, so there can't be an expectation that it's used safely for signing either. The real reason is key management. –  Gilles Dec 5 '13 at 16:10
The user wanted just to know, if it is secure to use the same key pair for both operations..my example shows what could go wrong (an insecure algorithm can affect the secure one) so I think it is appropriate. Even though, there could of course exist different reasons not to use the same key pair for both operations... –  Juraj Dec 10 '13 at 13:37

If you use the raw RSA operation ($M^d \bmod n$ or $M^e \bmod n$), then no, it is unsafe to use the same key, because an attacker could trick the private key holder into signing a message $M$ (i.e. generating $M^d$) which is actually an encrypted message ($M = P^e$), thus allowing the attacker to recover the original plaintext ($(P^e)^d = P$). (The dual attack leads to a forgery.) However, the raw RSA operation has a whole range of other flaws that make it unsafe as an encryption or signature scheme.

Encryption and signature schemes based on RSA use padding modes. The standard padding modes include discriminants so that an encryption payload does not look like a signature payload. Therefore, it is safe, cryptographically speaking, to use the same RSA key pair for signature and encryption, provided that the key pair is used safely for signature and used safely for encryption.

However this is a bad idea for a different reason: key management. Signature keys and encryption keys have different requirements in terms of backups, access control, repudiation, etc. The fallback for a signature key in case of a catastrophic event is to destroy it to avoid future forgeries, so a signature key does not need to be backed up extensively. Conversely, the fallback for an encryption key is to keep it around to decrypt existing documents, so it needs to be backed up reliably. In case of a leak of a signature key, pre-existing documents are not affected; it is only newly produced signatures that must be repudiated. Conversely, in case of a leak of an encryption key, the confidentiality of all pre-existing documents is at risk, whereas new documents simply need to be encrypted with different keys. The constraints push in different directions, so the keys need to be managed differently, they need to be different.

-