In the case of RSASSA-PKCS1-v1_5, is it simply that the cryptographic libraries and APIs are designed to only sign if determined superficially that it has a private key, or is the public key mathematically incapable of signing? Or perhaps in asking this way there is some major wrong assumption I'm making about keypairs and how they can be used?
1
-
$\begingroup$ You'll have to define "mathematically capable", which is different from practically capable. That $n=p\,q$ with $p$ and $q$ primes and $p<q$ mathematically defines $p$ and $q$ from $n$. Are we thus "mathematically capable" of finding $p$ and $q$ from $n$? If yes, then we are "mathematically capable" of signing with the public key. If no, well, that's complicated, but the short answer is no. $\endgroup$– fgrieu ♦Nov 18, 2022 at 16:46
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Signature schemes are designed so that being in possession of the private key is required to sign messages. The public key in isolation only allows to verify signatures.
Compare this to public-key encryption schemes, where the private key is what is required to decrypt, while the public key in isolation is only capable of encrypting a message.
For more details on how asymmetric signature schemes are formalized, take a look at the appropriate section of any standard textbook, e.g. Chapter 13.3 of The Joy of Cryptography.
Another thing to keep in the back of your mind when studying RSA-based signature schemes is that, while the signature operation bears some resemblance to the encryption operation of textbook RSA, care must be taken not to conflate the two. For one the signature operation utilizes the private key, while encryption utilizes the public one. Further there are significant differences in the type of padding used in real-world schemes. See e.g. this answer for more on that.
