2
$\begingroup$

If RSA Signature is not Decryption, why is it not advisable to use same keys for enc/dec and sig/ver? What is the proof where you may be exposing your private key when you use the same one for decryption and signing? This is for RSA OAEP.

$\endgroup$
  • $\begingroup$ If despite the reasons given by EdC's answer you do want to do signcryption with RSA (without employing hashing), you could take a look of Example 3S of my RSA software in mok-kong-shen.de $\endgroup$ – Mok-Kong Shen May 21 '17 at 19:23
2
$\begingroup$

The advice to use different key pairs is not because there is a risk of exposing your key, just that enc/dec and sign/ver often have a different security level, or can become so in future.

E.g. If you are using signed and encrypted email for your job, it's not unreasonable for the company to have a copy of the decryption key so that they can read the emails sent to you (as a representative of the company). Where as there is no legitimate reason for the company to impersonate you, so there is no reason to provide them your signing key.

Even if this doesn't occur now, you may need to change this retrospectively. E.g. Even if a company doesn't keep a copy of the decryption key proactively, they may ask for it when you leave. If you've kept the keys separate there isn't really a problem with this (as long as you use separate keys for work and personal purposes), but you wouldn't want to hand over a key that could also be used for signing as that would allow you to be impersonated.

Similar situations can crop up in most contexts. E.g. I may want to make provisions for my heirs to decrypt my personal communication when I die, but would not want to enable them to impersonate me. By keeping the keys separate I can make provisions to release my decryption key on my death, but ensure the signing key dies with me.

| improve this answer | |
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.