Lets say we use RSA as the signature method.

Alice wants to send a message to Bob and uses RSA signing. For that she signs her message with her private key. But everybody could now have access to her message if one just decrypts the signature with Alice's public key.

What is the point of digital signatures if confidentiality is violated?

  • 2
    $\begingroup$ You use signatures for authenticity. ;) $\endgroup$ Jan 26, 2019 at 10:55
  • 8
    $\begingroup$ It may shock you to learn, that even a non-digital signature allows you to read the document that was signed! $\endgroup$ Jan 27, 2019 at 21:02

5 Answers 5


Digital signatures are not designed for confidentiality. For the simplest counterexample to the implicit conclusion that there is no point to digital signatures without confidentiality, consider the use of PGP signatures. People may sign a message that they send to a public mailing list, allowing others to verify that they indeed said that and not an imposter pretending to be them. Anyone can share the signed message with anyone else, and whoever they share it with can be certain that it was not tampered with and really was signed by who they say. With digital signatures, you no longer need to trust the messenger. The signed message speaks for itself.

Also, you seem to be misunderstanding how digital signatures work. It is not encryption that you decrypt to verify. A digital signature is a mathematical operation on a hash of the message that you verify is valid for the message. You don't recover the message itself from the signature, at least not for the most commonly-used digital signature schemes such as RSA.

The following is an example of a signed but unencrypted message generated with GnuPG:

Hash: SHA512

I'm forest, and I approve this message.

You can verify that this text was signed by the owner of 428DD60B.

Context: https://crypto.stackexchange.com/q/66760/54184

  • 9
    $\begingroup$ @Nime The first sentence in this answer says "Digital signatures are not designed for confidentiality", so "confidentiality would be violated" is non-applicable here, and a digital signature never promised that it would keep your message confidential to begin with. This is one reason why the common falsehood of signatures being "encrypt with the private key and decrypt with the public key" is completely wrong - signatures are completely unrelated to encryption, no matter how similar the operation looks in RSA (such examples ignore crucial details such as padding anyways). $\endgroup$
    – Ella Rose
    Jan 25, 2019 at 15:43
  • 4
    $\begingroup$ @Nime: It's important to recognize that every cryptographic technique solves a very small number of problems very well, and that moreover, those are the only problems they solve well. Cryptographic techniques solve problems like: verifiability, non-repudiation, confidentially, tamper resistance, tamper detection, key management, and so on but no one technique solves all those problems. "Hash and sign with private key" is a technique for solving some of those problems, but "confidentiality" is explicitly NOT one of them. Internalize that fact! $\endgroup$ Jan 25, 2019 at 19:33
  • 1
    $\begingroup$ @Nime: In particular, something that will help you is if you get out of the habit of saying "the security of resource X is based on..." and start saying "the security of resource X against attack Y is based on..." The security of a system can only be evaluated in the context of specific attacks. If you asked "what is the most secure door?" I think it would be reasonable to point out that the door to a nuclear reactor control room and a kindergarten crayon supply room have different likely attacks. $\endgroup$ Jan 25, 2019 at 19:36
  • 1
    $\begingroup$ @supercat The only similarity is that they both involve modular exponentiation. Other than that, they are completely different. The padding is necessarily different (OAEP vs PSS), the source of the exponents are different (public vs private exponent), the way the result is used is different, the performance is different, the security requirements are different, etc. That's like saying SipHash and ChaCha20 are the same thing because they both use the exact same primitives (add, rotate, and xor). $\endgroup$
    – forest
    Jan 26, 2019 at 2:28
  • 2
    $\begingroup$ @supercat If it doesn't provide confidentiality, then it's not encryption, irrespective of whether or not some of the operations that it's using happen to be similar to those used in an encryption scheme. You wouldn't describe encryption as "signing with your public key" because it's clearly absurd, but by your argument it's a reasonable statement to make. $\endgroup$
    – Ella Rose
    Jan 26, 2019 at 15:33

Consider the paper-based analogy:

[Alice] signs her message m with [her] private key.

Similarly, Alice signs a document on paper with her signature.

everybody could now have access to her message if one just [verifies] the signature with Alice's public key.

And everyone who has access to the document, can verify that Alice has signed the document.

In practice, they'll need some way to know what Alice's signature looks like (or what their public key is), and not everyone can do that, just those who get a copy of the document.

The bottom line is that signatures provide only authentication, not privacy. Privacy has to be handled separately, with encryption, or with trusted couriers and safes or such.


As other users have correctly stated, signing is to ensure message integrity, not confidentiality.

Note that it is possible to encrypt a message first, then sign it.

This will protect the confidentiality of the message, and even if it is compromised, you will still be able to protect against 'man in the middle' attacks by verifying the signature.


You don't encrypt the message with your private key.

The point of digital signatures is for verifying the authenticity of the message.

Simplified: You create a hash of the message $H(m)$ and then sign the hash $S(H(m))$. This is then appended to the message and finally both are sent to the receiver.

The message is usually still encrypted with the receiver's public key, so that only the receiver can decrypt the message with his private key.


To provide some additional context for the information provided in the other answers.

It is true that RSA is used to encrypt / decrypt information


In almost all real-world cases RSA is not used to encrypt a large message being exchanged but rather just used to encrypt the hash of the message (this is signing / creating a signature for the message)

As other answers point out, this makes it possible for the receiver to know with certainty that the message has not been tampered with by some intermediary.

The steps are (a bit simplified for illustration purposes):

  1. Alice creates message for Bob
  2. Alice creates a hash for the message
  3. Alice encrypts the hash value using her private key - this 'encrypted hash value' is the signature for the message
  4. Alice sends the message, in clear text, plus the signature (encrypted hash value) to Bob
  5. Bob creates a hash for the message (using the same hash algorithm as Alice used in step 2)
  6. Bob decrypts the encrypted hash value provided by Alice, using Alice's public key
  7. Bob compares his hash value for the message (from step 5) with the decrypted hash value (from step 6)

If the two hash values compared in step 7 are the same, Bob knows with certainty that the signature was created by Alice (since only she has access to her private key) and that the message he received was exactly how Alice authored it, i.e. no one has made changes to the message.

On the topic of confidentiality, encrypting the message itself is almost always done using an encryption algorithm other than RSA (since RSA is slow and optimized for encrypting small information sets). This can be accomplished many different ways but one option is to add to the steps:

  1. Alice creates message for Bob
  2. Alice encrypts the message using a symmetric key encryption algorithm using key of her choosing that only she knows
  3. Alice encrypts the symmetric key using Bob's public key and adds it to the end of the message
  4. Alice creates a hash for the message
  5. Alice encrypts the hash value using her private key - this 'encrypted hash value' is the signature for the message
  6. Alice sends the encrypted message, plus the signature (encrypted hash value) to Bob
  7. Bob creates a hash for the message (using the same hash algorithm as Alice used in step 4)
  8. Bob decrypts the encrypted hash value provided by Alice, using Alice's public key
  9. Bob compares his hash value for the message (from step 7) with the decrypted hash value (from step 8)
  10. If the hashes match, Bob takes the encrypted symmetric key value from the end of the message and decrypts it using his secret key
  11. Bob decrypts the encrypted message using the same symmetric encryption algorithm Alice used in step 2, using the symmetric key value from step 10

With these steps Bob knows Alice authored the message and only he is able to decrypt it since the symmetric key used to encrypt the message was encrypted using his public key. I.e. only Bob is able to get the symmetric key value since only he has access to his private key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.