Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to decide, whether a document, which I am given, was correctly signed by a private key.

my Ideas is to sign the document id using RSA with the private key and to print the following onto the document:

encrypt(privateKey, id)
  • Which requirenments should be fullfilled by the id, for the encrypt(privateKey, id) to be safe?
  • Is it safe, to publish both: plaintext and the encryption, when I am choosing the paintext?
  • Is there a safe cryptography method, which would allow to minimize the encrypt(privateKey, id) String? In this special case the attacker has a very limited amount of trials (1-2) to verify whether it's fake signature is legal. When the attacker does not provide a text with a valid signature after the second trial - he is identified as a cheater. The public key is not really public here. I think, that a symmetric encryption would be better here, but the limitation to an asymmetric encryption exists due to backward compatibility reasons.


 id = ABX3193
 privateKey = 12f21te32223523fefff5z....
 encrypt(privateKey, id) = ??????
share|improve this question
By using a signature operation that's designed for signing that applies proper padding. Most RSA libs have a proper RSA signature function. Don't use textbook RSA, and don't "encrypt with the private key". – CodesInChaos Jul 8 '13 at 8:49
Thnx for the tips! But what do you mean by don't "encrypt with the private key"? Do you mean that this is not a proper english expression, to describe the process of asymmetric encryption? – Skip Jul 8 '13 at 8:55
How do you derive the id from the document ? Related and more relevant to the security, how are you sure that a document with a given id cannot be modified ? The problem is that with a short id, nothing really prevents id-collisions. If that occurs, how do you know which of the two documents with the same id have been signed ? – minar Jul 14 '13 at 21:49
Thnx minar, I added some text to the describtion (about a limited amount of trials for the attacker, to verify whether a text has a correct signature. When the attacker does not provide a text with a valid signature - he is identified as a cheater ) – Skip Jul 29 '13 at 7:34
Are you sure the limitation is to asymmetric encryption, as opposed to (asymmetric) digital signatures? $\;\;\;$ – Ricky Demer Jul 29 '13 at 11:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.