If a private key decrypts what its public key encrypts, can the public key conversely decrypt what its private key encrypts?

Question

Whilst studying the material for the CCNAS exam, I have encountered something on the cryptographic systems chapter that I am not sure about. Cisco Netacad states that "Asymmetric algorithms use two keys: a public key and a private key. Both keys are capable of the encryption process, but the complementary matched key is required for decryption. For example, if a public key encrypts the data, the matching private key decrypts the data. The opposite is also true. If a private key encrypts the data, the corresponding public key decrypts the data.".

Can someone clarify whether the last statement made is correct; that if the private key encrypts the data then the corresponding public key decrypts the data. As far as I know this is not true?

Any clarification here would be appreciated!

Answer 1

You are right if you feel that this is nonsense; it is, fundamentally, a category error. However, it is an unfortunately popular confusion of ideas that public-key signature is ‘just encryption with the private key’.

There is a tempting grain of truth to this notion—deep in the underbelly of the mathematics of one family of cryptosystems, with no practical consequences whatsoever, and not only is it completely useless to a practitioner but it is likely to get you into deep trouble if you try to act on this idea in any meaningful way.

Here's the tempting grain of truth. RSA-based encryption schemes and signature schemes involve computing $e^{\mathit{th}}$ powers modulo a large composite $n$ with large prime factors as part of the public operation (encrypting, verifying), and computing $e^{\mathit{th}}$ roots modulo $n$ for the private operation (signing, decrypting). And there the resemblance ends—there is no resemblance in the rest of the details of how you actually build encryption and signature of messages out of this.

Not only does the resemblance end there, but this tempting grain of truth is limited to RSA-based cryptosystems—while most of the world today has moved on to elliptic-curve cryptography for almost all new applications, in which signature and encryption schemes are completely different, and is preparing in the NIST PQCRYPTO competition to adopt a new lattice- or isogeny- or hash- or MQV- or somethingcrazy-based cryptosystem that will resist all current known methods of quantum cryptanalysis.

Answer 2

if the private key encrypts the data then the corresponding public key decrypts the data. As far as I know this is not true?

You are correct that the private key does not encrypt anything, and the public key does not decrypt anything.

You do not encrypt with the private key; With textbook RSA signatures, the signing operation incidentally happens to be the private key operation, which is the same as the public key operation with a different exponent. However, for many/most other public key encryption and signature schemes, it does not work that way. I suspect this may be the source of the confusion.

Simply taking an arbitrary public key encryption algorithm and using the private key to try and generate a signature is not guaranteed to even yield a valid signature in terms of algorithmic correctness, let alone a secure signature.

Additionally, the claim that the public key or private key is always capable of encrypting is not necessarily true: "Asymmetric algorithms" does not necessarily mean "Public-Key Encryption", as Key Encapsulation Mechanisms (KEM) and digital signature schemes both exist. You certainly can't encrypt anything with a public key from a signature scheme.