In theory, are there algorithms where everybody can read a message but only one person can write it?

Question

I know that there are a lot of asymmetric algorithms out there that use the public key to encrypt and the private key to decrypt. I was thinking about having exactly the opposite.

I do also know that the current way of doing it is sending it in plaintext and adding a signature to verify that its coming from the correct sender. But for me it sounds like it is just some sort of "overhead" with an additional signature to check and transmit.

In my mind it would be cool to say: If you can decrypt it, it is the right sender and if you can't, someone must have altered it / is not trustworthy.

If there isn't such thing, why is that exactly? Because the signature "method" is the way to go?

Answer 1

Yes, that's signature with message recovery.

In signature with (total) message recovery, the signature contains the message, and the message is a byproduct of verifying the signature with the public key.

The most common such system is the RSA-based ISO/IEC 9796-2 in total message recovery mode. Simplified: the message $M$ (and, in scheme 2, some added randomness) is reversibly transformed into a redundant message representative $R$ about as wide as the RSA modulus (but smaller), then the signature is computed as $S\gets R^d\bmod N$ where $(N,d)$ is the private key. Signature verification goes $R\gets S^e\bmod N$ where $(N,e)$ is the public key, then checks the redundancy of $R$, and extracts the message $M$ from $R$. Notice that $M$ is an ouput (rather than an input) of the signature verification process. More details there.

There are other signature schemes with message recovery; e.g. the Rabin variant of the above, the schemes in ISO/IEC 9796-3, and ECPVS of ANSI X9.92-1 which optimizes the payload embedded in short signatures

Answer 2

If you can decrypt it, it is the right sender and if you can't, someone must have altered it / is not trustworthy.

Then by definition what you're looking for is called a signature. You're asking for something which is a signature, but is not called a signature. Sorry, there's no such thing. A signature is called a signature. And verifying a signature is called verification, not decryption.

It's not that “the signature method is the way to go”. It's that the properties you want are that of a signature. Therefore, anything that does what you want is a signature.