We all know that signing a document is to encrypt its hash using signer's private key. https://commons.wikimedia.org/wiki/File:Digital_Signature_diagram.svg I've been searching the web for days, looking for a simple online page where you can sign a text using your private key (you can do this part offline), and others can verify a text's author inputting the received text, signature and signer's public key. But I didn't find anything, just symmetric encryption like https://encipher.it So I decided to create myself an app using PHP's OpenSSL capabilities. Here's the source code http://pastebin.com/Czp3SZHd and the live demo http://testrsa.bugs3.com/rsa-sign-verify.php
The problem is that I've read people saying that "you can't encrypt using your private key", "signing is not the same as encrypting", "raw RSA, without padding, is insecure".
So I'm confused. Isn't public-key cryptography supposed to be secure? That is, it isn't feasible to calculate the private key from the public key, not even having samples of plain and cipher texts, encrypted with the private key.
I have updated the key length, from RSA-1024 to RSA-2048. Now I use phpseclib with RSA-PSS as default padding for signing. It also uses setHash('sha512').
Of course, I'm not taking into account other factors like server-client communication, key generation, etc.