Is there any downside to encrypting the original message for signing purposes. I understand this does not provide actual protection, and any one with the public key (any one in the world if the public key is made completely public), however, it would seem if the public keys were kept restricted to TLS tunnels and required password access, this would seem to be a small layer of protection. The upside is small, but is there any downside?
There are actually a few downsides which mostly depend on the size of the original message.
So recall that for signing purposes, the hash (or message digest) is used to sign the document. Thus assuming that the message is large we can face several possible issues:
1. Efficiency: Recall that signature schemes use asymmetric encryption which is much slower than symmetric encryption. So if you were to sign the entire message it could take some time. (Hash or message digest is relatively small in size and thus fast to sign)
2. Integrity: Given the message is too large (for the signature space) the message may be required to be split into separate blocks (separate messages). Now each message created must now be signed differently and the order of the message blocks may need to be preserved which is an additional overhead.
3. Compatibility: Some signature schemes such as RSA can not operate on Bit strings so it adds extra difficulty re-configuring the message or changing the signature scheme.
Of course, if the message is small, it can get away with the first two issues with small overheads, but it's probably better to use a key-sharing encryption scheme with signatures rather than have to go through all this overhead.
Let me know if that raises any other questions, Cheers!
It is not possible to directly encrypt with the private key as the signature value is exactly the size of the private key. So a message + signature it will be too large for the private key to encrypt. It would therefore be required to use a hybrid cryptosystem (e.g. AES + RSA) to encrypt in the first place.
It is normally required to encrypt the signature, otherwise an adversary may try and reconstruct the message and verify it against the known signature.
Generally encryption is not performed with private keys:
- the operation of doing so may simply not be available (e.g. if the key is stored in hardware, or if a library has a higher level API);
- the operation may fail if the private key (only) contains the CRT parameters (and not the private exponent);
- the operation may fail if the implementation requires a small or even specific public exponent;
- the operation may choose the wrong padding mechanism for signing;
- the operation may not be protected against side channel attacks that could be used to find the private key.
If you need to keep the public key secret then you might as well use symmetric encryption: distribute a symmetric key and perform authenticated encryption for the recipients. You can still sign the plaintext message if that's required.
You could of course encrypt a symmetric key using the public key and decrypt that at the side that wants to encrypt the message. Then that could be used to perform the authenticated encryption. It's would still use the public key but it avoids many drawbacks listed above.
Using TLS could also be an option, although you'd still have to control who is allowed inside, of course.