Good practice to separate RSA key pairs used for encryption and digital signatures

Question

I've got the following related questions:

If Alice is using the same RSA key pair for both digital signatures and encryption, explain how Bob could forge Alice’s signature on a message of his choice if Alice is ‘foolish’ enough to help him.
What other reasons are there for keeping these key pairs separate?

The idea of these kind of questions is often that you try and learn from them. I've provided some answers, but beware that performing this as an exercise is much more valuable. — Maarten Bodewes, Feb 24, 2017 at 0:33

Maarten Bodewes · Accepted Answer · 2017-02-24 00:32:20Z

I can answer this as follows:

If Alice would decrypt a random "ciphertext" for Bob and then return the decrypted message then Alice would have created a signature. Bob simply sends the required input to create a signature by performing modular exponentiation with the private exponent (or CRT parameters, of course). This would however only work for plain/textbook RSA decryption, which is not something you should use in practice.
Key management reasons:

a. You may always want to decrypt your stored ciphertext, but you may not always want to generate signatures with that particular private key.

b. You may not want to make your private key available for the other operations if you only require to perform decryption or signature generation.

c. Flexibility. Maybe you want to put one key pair on a smart card and keep the other in memory. Maybe you don't want to install the signature key on a device that just needs to perform decryption. Protect one with a PIN or password and use the other in an automated environment.

1 Answer 1