In textbook RSA with no padding schemes, is it possible to forge a ciphertext that decrypts to a known plaintext when the ciphertext is encrypted using the private key and decrypted with the public key?
Specifically, assume the plaintext and public key are known. The private key is unknown. In this scheme, person A encrypts a message with the private key. Then, person B decrypts this ciphertext using person A's public key. Person B then checks the decrypted message against a static predetermined plaintext to validate that the message actually originated from person A, almost like a signature. The plaintext is not a hash but rather a relatively small magic number.
I want to know if there are any feasible attacks against this scheme to forge a fake ciphertext
c that decrypts to the expected plaintext, without knowing the private key.
In this case, the exponent is 65537 and the key is 2048 bits.