Simple question, but I couldn’t find an answer as I know about signing but don’t want it.

The aim would be to encrypt someone’s bet parameter as a short message using the private key and use the public key in order to verify/prove that the decrypted short cyphertext match the original parameters while making the cyphertext resulting from the bet’s parameters unpredictable by the gambler (for example checking VRF.decrypt(ciphertext)==bet.originalid on the client/public side).

The messages would be shorter than 512bits so the decryption/encryption would be performed using the rsa’s keys directly.


2 Answers 2


Are you looking for a way to 'sign' a message with a private key, so that someone with the public key can verify it (and no one without the private key can modify it)?

Well, there are algorithms (called, oddly enough, signature algorithms) that can do that. Some of them are ECDSA, EdDSA and BSS (focusing on the ones with short signatures).

RSA can also sign messages too; however you really need an RSA key of at least 2048 bits (and so you really don't get any space savings by being able to place the message in the signature).

  • $\begingroup$ No. I know about signing. But I really want to make encryption impossible (with the private key) and decryption available by anyone. $\endgroup$ Commented Feb 17 at 9:04
  • $\begingroup$ @user2284570: how is that different from signing? Yeah, with signing, the text is in the clear; however with 'private key encryption', anyone can recover it anyways, so that wouldn't appear to be a useful distinction... $\endgroup$
    – poncho
    Commented Feb 17 at 11:39
  • $\begingroup$ Isn’t verifying signature with rsa involve chdcking that the output generated by the signature and the message produce the public key too? $\endgroup$ Commented Feb 17 at 14:04
  • $\begingroup$ @user2284570: no; instead, it checks to see if the public key operation (using the public key) on the signature generates a value that is consistent with the hash of the message (which might be checking if it is the padded hash if you're doing PKCS #1, or it might be more involved if you're doing PSS) $\endgroup$
    – poncho
    Commented Feb 17 at 20:37

It looks like the problem is solved by so-called signature giving total message recovery. As a functional black box that goes:

  • The generation procedure outputs a public/private key pair $\mathrm{Pub},\mathrm{Priv}$.
  • The signing procedure takes $\mathrm{Priv}$ and any message $M$ of size bounded by so-called capacity. It outputs a signature $\mathrm{Sig}$.
  • The verification procedure takes $\mathrm{Pub}$ and $\mathrm{Sig}$. It outputs $M$ if $\mathrm{Sig}$ was produced by signing with $\mathrm{Priv}$, or an error indication.

The critical difference with the more common breed of signature is that in signature giving total message recovery, the message is an output of the signature verification procedure, rather than an input.

Even though the message typically is not readily apparent in the signature, this is not encryption, because the procedure to obtain $M$ from $\mathrm{Sig}$ only requires $\mathrm{Pub}$, which as it's name implies is assumed public thus known to all. Further, in some schemes, it's possible to recover $\mathrm{Pub}$ given example $M/\mathrm{Sig}$ pairs.

The expected security property is sEUF-CMA (strong Existential UnForgeability under Chosen-Message Attack): it is computationally impossible for an adversary knowing $\mathrm{Pub}$ to exhibit any $\mathrm{Sig}$ that pass verification other than those $\mathrm{Sig}$ obtained from a signature oracle that takes any message $M$ within capacity and discloses a corresponding $\mathrm{Sig}$.

The most widely used family of signature with total message recovery is ISO/IEC 9796-2 (preview only). It's scheme 3 instantiated with 2048-bit RSA and SHA-256 has a 256-byte signature, capacity 222 bytes, and has some level of security reduction to the RSA problem. It's in org.bouncycastle.crypto.signers.ISO9796d2PSSSigner.

They are others schemes based on the Discrete Logarithm Problem in some (e.g. elliptic curve) group. They are standardized in ISO/IEC 9796-3 (preview only), and for Elliptic Curve Pinstov-Vanstone also in ANSI X9.92-1 (paywalled) originally in Leon A. Pintsov and Scott A. Vanstone's Postal Revenue Collection in the Digital Age, in proceedings of RSA2000 (paywalled). These schemes tend to have lower signature size (e.g. 64 bytes) and capacity (e.g. 16 bytes), faster key generation and signature, slower verification.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.