Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 0 down vote favorite

Why is encoding using the private key used for signing? Wouldn't it make sense to keep the premise, that private is for decoding and public is for encoding? i.e. create a hash and threat it as a result of the crypting and decrypt it. The decrypted value being the "signature". Than when someone want to validate the signature, he would encrypt the signature and he would get the hash.

Am I missing something? Why is this not used?

share|improve this question
Sorry, it is not really clear what you mean. What you describe is (with some complications left away) how an RSA signature works. What actually is your question? – Paŭlo Ebermann♦ May 28 '12 at 18:42
It is? Great :) I assumed it works somehow differently = that it uses different way to "encode" then m^d (mod n)... – Tomáš Fejfar May 28 '12 at 18:55
1  
These are the "complications left away". To do it securely you'll have to use some kind of padding, and the padding schemes used for signing are something else than the padding schemes used for encryption (and obviously it is not the decryption unpadding). But the actual keyed operation is the same for signing, validating, encrypting and decrypting. – Paŭlo Ebermann♦ May 28 '12 at 19:00

1 Answer

up vote 4 down vote accepted

Your question appears to be "why do we use the terminology 'encoding' when talking about what we do as a part of the signature operation". Well, we don't (at least, I don't, and I don't remember hearing that terminology from someone else).

As for RSA, well, the terminology you use is moderately irrelevant (as long as you do the cryptographical operations correctly, it doesn't matter what you call them); on the other hand, encoding would appear to imply that you are taking a 'signal', and putting it into a different representation, while decoding would appear to imply that your reversing that operation, and are putting the signal back into its original state. While I suppose you could call the signature operation an "encoding" one, calling it a "decoding" one would appear to me to be an abuse of the terminology.

AS for DSA, well, your description of "encrypt the signature and he would get the hash" is not how DSA verify works; instead, the verifier inserts the signature, values from the public key and the hash into a formula, and if both sides of the formula are the same value, then the signature verifies. There's nothing that can be usefully described as "decoding" here.

share|improve this answer
Thanks for your answer. You are correct - that it's mostly that I don't like terminology. Note that the private exponent is called d (as in decrypting) in most resources and the public is called e (as in encrypting). That puzzled me. – Tomáš Fejfar May 28 '12 at 19:00
1  
@TomášFejfar: I believe that the common $d$ and $e$ convention dates back to the early days of RSA (probably the original SciAm article). While it's too historically entrenched to modify, you shouldn't think that it indicates what modern thinking of RSA is. – poncho May 28 '12 at 19:08
In PKCS#1 (the RSA standard), the term "encoding" clearly indicates all the various steps (including padding) that turn the message into an integer suitable for the RSA algorithm. I would not say that the terminology is irrelevant, at least if we give a value to the ability to be understood by the rest of the world... – SquareRootOfTwentyThree May 28 '12 at 19:29
@SquareRootOfTwentyThree: I forgot about that. On the other hand, I would note that PKCS#1 uses that for the operations other than the raw RSA operation, while the OP was talking about about the raw RSA operation itself. – poncho May 28 '12 at 19:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.