I know that there are a lot of asymmetric algorithms out there that use the public key to encrypt and the private key to decrypt. I was thinking about having exactly the opposite.

I do also know that the current way of doing it is sending it in plaintext and adding a signature to verify that its coming from the correct sender. But for me it sounds like it is just some sort of "overhead" with an additional signature to check and transmit.

In my mind it would be cool to say: If you can decrypt it, it is the right sender and if you can't, someone must have altered it / is not trustworthy.

If there isn't such thing, why is that exactly? Because the signature "method" is the way to go?

  • 1
    $\begingroup$ Change the title of your post, because the very 1st your sentence answers your question: asymmetric algorithms. You are actually asking about signature. That's why please change your question accordingly. $\endgroup$
    – mentallurg
    Jul 1, 2019 at 1:02

2 Answers 2


Yes, that's signature with message recovery.

In signature with (total) message recovery, the signature contains the message, and the message is a byproduct of verifying the signature with the public key.

The most common such system is the RSA-based ISO/IEC 9796-2 in total message recovery mode. Simplified: the message $M$ (and, in scheme 2, some added randomness) is reversibly transformed into a redundant message representative $R$ about as wide as the RSA modulus (but smaller), then the signature is computed as $S\gets R^d\bmod N$ where $(N,d)$ is the private key. Signature verification goes $R\gets S^e\bmod N$ where $(N,e)$ is the public key, then checks the redundancy of $R$, and extracts the message $M$ from $R$. Notice that $M$ is an ouput (rather than an input) of the signature verification process. More details there.

There are other signature schemes with message recovery; e.g. the Rabin variant of the above, the schemes in ISO/IEC 9796-3, and ECPVS of ANSI X9.92-1 which optimizes the payload embedded in short signatures


If you can decrypt it, it is the right sender and if you can't, someone must have altered it / is not trustworthy.

Then by definition what you're looking for is called a signature. You're asking for something which is a signature, but is not called a signature. Sorry, there's no such thing. A signature is called a signature. And verifying a signature is called verification, not decryption.

It's not that “the signature method is the way to go”. It's that the properties you want are that of a signature. Therefore, anything that does what you want is a signature.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.