What's wrong with RSA and OpenSSL?

Question

We all know that signing a document is to encrypt its hash using signer's private key. https://commons.wikimedia.org/wiki/File:Digital_Signature_diagram.svg I've been searching the web for days, looking for a simple online page where you can sign a text using your private key (you can do this part offline), and others can verify a text's author inputting the received text, signature and signer's public key. But I didn't find anything, just symmetric encryption like https://encipher.it So I decided to create myself an app using PHP's OpenSSL capabilities. Here's the source code http://pastebin.com/Czp3SZHd

The problem is that I've read people saying that "you can't encrypt using your private key", "signing is not the same as encrypting", "raw RSA, without padding, is insecure".

So I'm confused. Isn't public-key cryptography supposed to be secure? That is, it isn't feasible to calculate the private key from the public key, not even having samples of plain and cipher texts, encrypted with the private key.

UPDATE:

I have updated the key length, from RSA-1024 to RSA-2048. Now I use phpseclib with RSA-PSS as default padding for signing. It also uses setHash('sha512').

Source: http://pastebin.com/rSzQ5uKs

Of course, I'm not taking into account other factors like server-client communication, key generation, etc.

Answer 1

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because:

1. It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely descriptive of other common signature schemes;
2. It misses an important step, padding, which is different for RSA signature and RSA encryption. If we use no padding, some attacks apply (in particular, that allow computing signature of a document from a moderate number of signatures of other chosen documents).

PHP's openssl_private_encrypt used in the software linked in the question is thus horribly named (it should be openssl_RSA_sign), but when used with OPENSSL_PKCS1_PADDING (which seems to be the default), I believe it uses RSASSA-PKCS1-V1_5, an RSA signature padding; it's a tad obsolete and lacking a strong security argument (contrary to RSASSA-PSS), but stands currently unbroken.

Note: the linked software uses SHA-1, and that's obsolete, and broken by the definition we use in cryptography. It was practically and publicly broken in 2017.

Note: the linked application is at best as worth of trust as the weakest of the web server running it, the web client used to access the website for signature and that used for signature verification, the cryptography between server and clients, the source of the public key, the generator of the private key and anything that was ever used to handle it.

Answer 2

We all know that signing a document is to encrypt its hash using signer's private key.

Wrong.

Because...

• Textbook RSA is not secure, and secure schemes are not just the reverse of each other.

• With other algorithms than RSA, encryption and signing is very different in the first place.

So I'm confused. Isn't public-key cryptography supposed to be secure?

Sure, if used correctly.

For encrypting, there's eg. RSA-OAEP which is believed to be reasonable secure. For signing, eg. RSASSA-PSS can be used. And if you look up the details for this schemes, they are much more than the textbook version, and do not resemble each other (as much)