What is the point of digital signatures if confidentiality is violated?

Question

Lets say we use RSA as the signature method.

Alice wants to send a message to Bob and uses RSA signing. For that she signs her message with her private key. But everybody could now have access to her message if one just decrypts the signature with Alice's public key.

What is the point of digital signatures if confidentiality is violated?

Answer 1

Digital signatures are not designed for confidentiality. For the simplest counterexample to the implicit conclusion that there is no point to digital signatures without confidentiality, consider the use of PGP signatures. People may sign a message that they send to a public mailing list, allowing others to verify that they indeed said that and not an imposter pretending to be them. Anyone can share the signed message with anyone else, and whoever they share it with can be certain that it was not tampered with and really was signed by who they say. With digital signatures, you no longer need to trust the messenger. The signed message speaks for itself.

Also, you seem to be misunderstanding how digital signatures work. It is not encryption that you decrypt to verify. A digital signature is a mathematical operation on a hash of the message that you verify is valid for the message. You don't recover the message itself from the signature, at least not for the most commonly-used digital signature schemes such as RSA.

The following is an example of a signed but unencrypted message generated with GnuPG:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I'm forest, and I approve this message.

You can verify that this text was signed by the owner of 428DD60B.

Context: https://crypto.stackexchange.com/q/66760/54184
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmJUlCwACgkQBh18rEKN
1gt2EQ/+MIZas1rNvb2Hhv2lETp382D0qQSxPKwLuCsSS06FPOVBtVXT028nY7GO
YJdPtBnECVPkVxSmJzZOKFWR5bepoW7ihENNo5p3+wniejLCAa04mkQVDZNoodVI
ciOIcGQmZINvsi1N6kuzjOGJz9svrmYJAaljaJtMU5hHIYVgHG0/K4kANpVRzH5R
cvSrjwctSVCVVBJYe41aiKRZyasSF1zU9O5w+8QwdbBHNrweBUi8x+0mnmIqFYbz
hRYpDjIcu7FVInJyJamHO68Keka7np8ha39y6RDFKpTTXLqHWcKCtuuuUmI+3TPL
xhF3fXJnVWUCYy4cMgv8mYcwrzo736XQmeeEwzq7P0STYSpyxlTjc7ZU52CevA3Y
GDloEFlUwcrd0btkFQ9e/EGz4wjC0fTkYIjQceEZ+fNmvwTxaNax3wKb2iWeZtdj
tbRAlA1Wyvgh35U2rhTuvxae3ljwY7EOi4AKImRWo/nGbpW6GCPH6Oxm95wvUaGG
KGkGS5NWmGdHf3E73blmCnOs+MzxpOjgCejjLhCCjU4iLc5UIYBaJjmWdFg/kCiH
ame/OswTaDxPaCmfSxGOlBp1T8m/N8Wcir2mKRZC0UAYzO3YHGe//mASgSE+iDPE
TPQ6mx03ENJeItKpegdY5TC6Z2SFLRVNGmM1/m5/c1/r4g5CvF8=
=cCpR
-----END PGP SIGNATURE-----

Answer 2

Consider the paper-based analogy:

[Alice] signs her message m with [her] private key.

Similarly, Alice signs a document on paper with her signature.

everybody could now have access to her message if one just [verifies] the signature with Alice's public key.

And everyone who has access to the document, can verify that Alice has signed the document.

In practice, they'll need some way to know what Alice's signature looks like (or what their public key is), and not everyone can do that, just those who get a copy of the document.

The bottom line is that signatures provide only authentication, not privacy. Privacy has to be handled separately, with encryption, or with trusted couriers and safes or such.

Answer 3

As other users have correctly stated, signing is to ensure message integrity, not confidentiality.

Note that it is possible to encrypt a message first, then sign it.

This will protect the confidentiality of the message, and even if it is compromised, you will still be able to protect against 'man in the middle' attacks by verifying the signature.

Answer 4

You don't encrypt the message with your private key.

The point of digital signatures is for verifying the authenticity of the message.

Simplified: You create a hash of the message $H(m)$ and then sign the hash $S(H(m))$. This is then appended to the message and finally both are sent to the receiver.

The message is usually still encrypted with the receiver's public key, so that only the receiver can decrypt the message with his private key.

Answer 5

To provide some additional context for the information provided in the other answers.

It is true that RSA is used to encrypt / decrypt information

However:

In almost all real-world cases RSA is not used to encrypt a large message being exchanged but rather just used to encrypt the hash of the message (this is signing / creating a signature for the message)

As other answers point out, this makes it possible for the receiver to know with certainty that the message has not been tampered with by some intermediary.

The steps are (a bit simplified for illustration purposes):

1. Alice creates message for Bob
2. Alice creates a hash for the message
3. Alice encrypts the hash value using her private key - this 'encrypted hash value' is the signature for the message
4. Alice sends the message, in clear text, plus the signature (encrypted hash value) to Bob
5. Bob creates a hash for the message (using the same hash algorithm as Alice used in step 2)
6. Bob decrypts the encrypted hash value provided by Alice, using Alice's public key
7. Bob compares his hash value for the message (from step 5) with the decrypted hash value (from step 6)

If the two hash values compared in step 7 are the same, Bob knows with certainty that the signature was created by Alice (since only she has access to her private key) and that the message he received was exactly how Alice authored it, i.e. no one has made changes to the message.

On the topic of confidentiality, encrypting the message itself is almost always done using an encryption algorithm other than RSA (since RSA is slow and optimized for encrypting small information sets). This can be accomplished many different ways but one option is to add to the steps:

1. Alice creates message for Bob
2. Alice encrypts the message using a symmetric key encryption algorithm using key of her choosing that only she knows
3. Alice encrypts the symmetric key using Bob's public key and adds it to the end of the message
4. Alice creates a hash for the message
5. Alice encrypts the hash value using her private key - this 'encrypted hash value' is the signature for the message
6. Alice sends the encrypted message, plus the signature (encrypted hash value) to Bob
7. Bob creates a hash for the message (using the same hash algorithm as Alice used in step 4)
8. Bob decrypts the encrypted hash value provided by Alice, using Alice's public key
9. Bob compares his hash value for the message (from step 7) with the decrypted hash value (from step 8)
10. If the hashes match, Bob takes the encrypted symmetric key value from the end of the message and decrypts it using his secret key
11. Bob decrypts the encrypted message using the same symmetric encryption algorithm Alice used in step 2, using the symmetric key value from step 10

With these steps Bob knows Alice authored the message and only he is able to decrypt it since the symmetric key used to encrypt the message was encrypted using his public key. I.e. only Bob is able to get the symmetric key value since only he has access to his private key.