Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is performing RSA encryption with the private key identical to performing RSA signature generation (signing)?

share|improve this question
Posted (again) to answer common mistakes found on stackoverflow. Please indicate any mistakes in the answer provided below (or provide a better one). –  owlstead May 4 at 16:44

2 Answers 2

up vote 3 down vote accepted

No, RSA encryption with a private key is not the same as RSA signature generation. RSA encryption can only be performed with an RSA public key according to the RSA standard.

The reason that they differ is mainly due to different padding techniques used. The RSA Cryptography Specifications clearly define different schemes for RSA encryption and RSA signature generation.

The older PKCS#1 v1.5 standard contains two padding schemes that are often simply referred to as PKCS#1 v1.5. The padding for these encryption and signature schemes are however quite different, which is reflected by their official names RSAES-PKCS1-v1_5 and RSASSA-PKCS1-v1_5. Fortunately that confusion is not present for the newer OAEP encryption - which uses RSAES-OAEP padding - and PSS signature generation schemes - which uses RSASSA-PSS padding.

The actual modular exponentiation is mathematically the same for RSA encryption with a public key and RSA signature generation using the private key. This is easily verified by looking at the last part of paragraph 5.2 [emphasis mine]:

The main mathematical operation in each primitive is exponentiation, as in the encryption and decryption primitives of Section 5.1. RSASP1 and RSAVP1 are the same as RSADP and RSAEP except for the names of their input and output arguments; they are distinguished as they are intended for different purposes.

In general, a signature created by performing RSA encryption will fail if the other party correctly implemented the verification method. However, some software libraries actually perform RSA padding for signature generation if the private key is used for encryption. One possible reason for this is SSL/TLS; versions of TLS up to v1.2 used a "signature" created from an MD5 hash concatenated with a SHA-1 hash, which is incompatible with many signature generators provided by libraries. So many libraries relied upon the encryption operation instead. Such - often undocumented - features should not be relied upon however.

So called "raw RSA" or "textbook RSA" - RSA without a padding scheme - simply applies the (modular) exponentiation. This is not safe for normal operation. An easy example is modular exponentiation of the number zero or the number one; this will simply return zero or one. Obviously this is not safe as the ciphertext is identical to the plaintext. Furthermore, raw RSA may be vulnerable to choosen ciphertext attacks which can provide information about the private key to an attacker.

Finally note that public keys do not require protection, while private keys should be kept secure at all times. Hence RSA encryption implementations - when programmed to be used with a public key - may not contain protection against side channel attacks, possibly exposing the private key to an attacker that is able to apply a side channel attack.

share|improve this answer
"Obviously this is not safe as the ciphertext is identical to the plaintext." I would say a bigger problem with unpadded RSA is vulnerability to chosen ciphertext attacks. –  Aleph May 4 at 18:14
@Aleph Yeah, I was struggling a bit with regard to that part, I wanted it to be easy to understand first. I'll add it to the end. –  owlstead May 4 at 18:18
Another thing: "Finally note that public keys do not require as much protection as private keys." This sounds a bit awkward, a public key is public so it doesn't need any protection at all. –  Aleph May 4 at 18:21
@Aleph Right! Amended. –  owlstead May 4 at 18:27

It depends on what you mean by RSA. If you mean the plain textbook RSA where $P = C^d \bmod n$ (decryption with private key $d$) and $S = M^d \bmod n$ (signature generation), then yes, they are the same.

However, textbook RSA is inherently unsafe, and for real-life RSA such as RSA-OAEP+ (encryption) or RSA-PSS (signatures) signing is not the same as decryption.

share|improve this answer
very well, I'll do that from now on. –  countermode May 5 at 21:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.