PGP double encrypt instead of signing?

Question

So, maybe this is a dumb question, or maybe it's something someone's already done and it's really common, but whatever, here goes:

Why do we sign a message with our private key and then encrypt it with our contact's public key, instead of encrypting our message with our private key and then encrypting it again with our contact's public key?

Wouldn't the latter be better?

Answer 1

In general, the high-level idea behind the Digital signatures is what you mention (Convincing the verifier about owning the secret key). We have to be careful in the Encryption schemes we care about the confidentiality and the message keeps secure against the malicious users while in the Signature schemes the authenticity matters and the message is public.

Let show what is the difference between the RSA encryption scheme and the RSA signature scheme.

RSA encryption scheme:

Setup:

• Selects two large prime number $p$ and $q$.
• Compute $n=pq$ and $\phi=(q-1)(p-1)$.
• Selects $1<e<\phi$ such that $\gcd(e,\phi)=1$.
• Calculate $d$ such that, $d\cdot e = 1 \mod(\phi)$.
• Then the pair of public keys are $(n,e)$ while the secret key is $d$.

Encryption:

• For a message $m$ compute $c=m^e \mod(n)$.

Decryption:

• For a given ciphertext $c$ a valid receiver who owns secret key $d$ can compute $m=c^d \mod(n)$.

RSA Signature scheme:

Setup:

• Selects two large prime number $p$ and $q$.
• Compute $n=pq$ and $\phi=(q-1)(p-1)$.
• Selects $1<e<\phi$ such that $\gcd(e,\phi)=1$.
• Calculate $d$ such that, $d\cdot e = 1 \mod(\phi)$.
• Then the pair of public keys are $(n,e)$ while the secret key is $d$.

Signing:

• For a message $m$ compute $sig=m^d \mod(n)$ and issue $(m,sig)$.

Verification:

• For a given pair of message and signature, a verifier by taking the pair of public keys can check $sig^e \mod(n)\stackrel{?}{=}m$.

As you can see, both approaches follow the same idea but in signature schemes, we use keys conversely. But we never use the term of Encryption with a secret key for the Digital signatures because the main point for the encryption is confidentiality of the message while in the signature the message has to publish with the signature.

The RSA signature is just an example while we know this scheme is forgeable if the adversary owns two valid signatures and multiplying them to get a third valid signature.