In RSA, it is basically equivalent to use the private key $d$ to encrypt as it is to use the public key $e$ to encrypt. They are exactly inverses: $e=d^{-1}$.

I need to know, are there other public key schemes like this? E.g., I do not think Diffie-Hellman is like this.

  • $\begingroup$ It is a bit unclear what you are asking for. Do you want a cryptographic scheme where the encryption/decryption algorithm is the same (e.g. ROT13) or does the fact that you have a couple (public key, private key) is mandatory. If so I would suggest you to take a look at Paillier cryptosystem, elliptic curve cryptography and Cramer–Shoup cryptosystem. $\endgroup$
    – Biv
    Commented Jan 18, 2016 at 12:07
  • $\begingroup$ Diffie-Hellman is a protocol to establish a shared secret, meaning Alice and Bob will have the same key at the end ($g^{ab}\mod p$), they can then use any symmetric crypto with that key. So it does not fulfil the requirements you are looking for. $\endgroup$
    – Biv
    Commented Jan 18, 2016 at 12:09
  • $\begingroup$ Is the idea of public and private key being inverse ($e = d^{-1}$) a condition to your question ? $\endgroup$
    – Biv
    Commented Jan 18, 2016 at 12:13
  • 1
    $\begingroup$ @Biv, I think the OP is asking for schemes where the algorithms for encrypting and decrypting are the same, but the supplied key material (to the algorithm execution) makes the difference between encryption and decryption. $\endgroup$
    – SEJPM
    Commented Jan 18, 2016 at 15:07
  • 1
    $\begingroup$ The things you're asking about are called trapdoor permutations. ​ ​ $\endgroup$
    – user991
    Commented Jan 18, 2016 at 20:35

1 Answer 1


What you seem to be looking for is a scheme like the following: It consists of two algorithms, a key generation algorithm $K$ and a "key use" algorithm $U$.

The key generation algorithm outputs a pair of keys $(k_0, k_1)$. The "key use" algorithm takes as input a key and an element from some set $S$ (which may depend on $k_0$ and $k_1$), and outputs an element of a set $S$, and satisfies $$U(k_b, U(k_{1-b}, s)) = s$$ for all key pairs $(k_0,k_1)$ output by $K$, all $b \in \{0,1\}$ and all $s \in S$.

Security-wise, for $b = 0$ and $b=1$, given a random $s \in S$ and the key $k_b$, it should be hard to find $t$ such that $U(k_b, t) = s$.

You can trivially turn this into a public key encryption scheme by choosing one of the keys as the encryption key and the other as the decryption key. Ditto for signature scheme.

To get secure schemes, you need to include padding schemes, hash functions or any of the usual stuff.

I don't off-hand know of any examples of such schemes, except for RSA with random exponents or RSA look-alikes. (RSA with small $e$ is not secure.) Diffie-Hellman is certainly not like this.

I don't know if this is a useful concept. It is somewhat similar to trapdoor one-way permutation, which you don't hear so much about anymore.

  • $\begingroup$ Could you elaborate on trapdoor one-way permutations please? $\endgroup$
    – Arnold
    Commented Jan 18, 2016 at 23:18
  • $\begingroup$ I've added a link. $\endgroup$
    – K.G.
    Commented Jan 19, 2016 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.