# What's wrong with RSA and OpenSSL?

We all know that signing a document is to encrypt its hash using signer's private key. https://commons.wikimedia.org/wiki/File:Digital_Signature_diagram.svg I've been searching the web for days, looking for a simple online page where you can sign a text using your private key (you can do this part offline), and others can verify a text's author inputting the received text, signature and signer's public key. But I didn't find anything, just symmetric encryption like https://encipher.it So I decided to create myself an app using PHP's OpenSSL capabilities. Here's the source code http://pastebin.com/Czp3SZHd

The problem is that I've read people saying that "you can't encrypt using your private key", "signing is not the same as encrypting", "raw RSA, without padding, is insecure".

So I'm confused. Isn't public-key cryptography supposed to be secure? That is, it isn't feasible to calculate the private key from the public key, not even having samples of plain and cipher texts, encrypted with the private key.

UPDATE:

I have updated the key length, from RSA-1024 to RSA-2048. Now I use phpseclib with RSA-PSS as default padding for signing. It also uses setHash('sha512').

Source: http://pastebin.com/rSzQ5uKs

Of course, I'm not taking into account other factors like server-client communication, key generation, etc.

• We all know that signing a document is to encrypt its hash using signer's private key. Not really, no. – deviantfan Nov 4 '16 at 9:32
• Now in 2019, the link to the live demo is not working anymore, and it sometimes reveals a page which offers how to make 2500€ per day, a 403 Forbidden error, an offer for a PDF viewer, ... – gog Apr 11 '19 at 13:17

To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because:

1. It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely descriptive of other common signature schemes;
2. It misses an important step, padding, which is different for RSA signature and RSA encryption. If we use no padding, some attacks apply (in particular, that allow computing signature of a document from a moderate number of signatures of other chosen documents).

PHP's openssl_private_encrypt used in the software linked in the question is thus horribly named (it should be openssl_RSA_sign), but when used with OPENSSL_PKCS1_PADDING (which seems to be the default), I believe it uses RSASSA-PKCS1-V1_5, an RSA signature padding; it's a tad obsolete and lacking a strong security argument (contrary to RSASSA-PSS), but stands currently unbroken.

Note: the linked software uses SHA-1, and that's obsolete, and broken by the definition we use in cryptography. It was practically and publicly broken in 2017.

Note: the linked application is at best as worth of trust as the weakest of the web server running it, the web client used to access the website for signature and that used for signature verification, the cryptography between server and clients, the source of the public key, the generator of the private key and anything that was ever used to handle it.

• Thank you @fgrieu for your time. One last question. Could you review my update and tell me what you think? – John Doe Nov 5 '16 at 16:22
• @Gemma Ortiz: I did not review either the original or the new code; I gave a look at it. I have not even looked at the underlying implementations. From that distance, it appears that the new PHP code uses SHA-512, and RSASSA-PSS with MFG1 on top of SHA-512. This is ample (thus fine) w.r.t. the security of 2048-bit RSA, which itself is respectable. Last note of the answer still applies. – fgrieu Nov 5 '16 at 18:11

We all know that signing a document is to encrypt its hash using signer's private key.

Wrong.

Because...

• Textbook RSA is not secure, and secure schemes are not just the reverse of each other.

• With other algorithms than RSA, encryption and signing is very different in the first place.

So I'm confused. Isn't public-key cryptography supposed to be secure?

Sure, if used correctly.

For encrypting, there's eg. RSA-OAEP which is believed to be reasonable secure. For signing, eg. RSASSA-PSS can be used. And if you look up the details for this schemes, they are much more than the textbook version, and do not resemble each other (as much)