Can messages be recovered from signatures if the private key is known?

Question

If the message that was signed with a digital signature is not known, can it still be recovered if you have the private key?

Answer 1

In generally it will not be possible: the signature generation generally includes hashing the message, and secure hashes are one-way functions.

Often the hash can be retrieved during verification with the public key. This is for instance the case for RSA. If you have the hash you can try all possible messages until you find one that calculates to that same hash. This will of course only work if the message space is restricted; the higher the number of valid messages, the lower the chance to find the right one. With a secure hash with any kind of secure output you can however be certain that if a matching message is found that it is the right one.

If the signature verification requires a hash as input, e.g. for ECDSA you may be required to perform the whole verification, which will take longer, so searching may take more time.

There are signature schemes that provide (partial) message recovery (see ISO/IEC 9796-2). In that case the public key verification operation will return (part of) the message. This is useful for data constrained devices such as smart cards.

For verification the private key is not needed, so the answer is no. Having the private key doesn't bring you any benefit over using the public key.