In common RSA encryption, a public key is used to encrypt message, and private key decrypts it. However, in digital signing, it's the other way around: Bob hashes his message, then encrypts the hash with his own private key, Alice uses Bob's public key to decrypt the encrypted hash.

What is the purpose of this opposition? Or It doesn't matter which key to encrypt/decrypt?

  • 1
    $\begingroup$ Welcome to Cryptography.SE We have lots of Q/A about this. If you search, you will find your answer and learn many other aspects on this subject. Note that it is merely on RSA that can be used to encrypt and sign. And don't forget that RSA sign!=decryption. $\endgroup$
    – kelalaka
    Oct 15, 2021 at 15:08
  • $\begingroup$ keyword to search: RSA sign and decryption... $\endgroup$
    – kelalaka
    Oct 15, 2021 at 15:10
  • $\begingroup$ I don't find useful info when searching with the whole sentence. I'm trying key words search then. Thanks for your suggestion. $\endgroup$ Oct 15, 2021 at 15:16
  • 1
    $\begingroup$ With RSA you are using modular exponentiation, but you are by definition not encrypting anything. Encryption is used to provide confidentiality, which you obviously do not do if you can "decrypt" with the public key. In the latest version of RSA they made pretty clear that there are differences between RSASP1 and RSAEP, even though in theory the operation is just modular exponentiation. Here is my extended answer. $\endgroup$
    – Maarten Bodewes
    Oct 15, 2021 at 15:29
  • 2
    $\begingroup$ Does this answer your question? Is RSA encryption with a private key the same as signature generation? $\endgroup$
    – kelalaka
    Oct 15, 2021 at 21:31

1 Answer 1


In asymmetric cryptography, it does matter which key we use to encrypt and which key we use to decrypt. From a high level, we want everybody to be able to encrypt so a public key is used for encryption. But we only want a certain party to decrypt (usually the party who created the key pair) so a private key is used for decryption. In other words, in the case of encryption/decryption, it's decryption that is the critical operation since it exposes what we're trying to hide - the plaintext.

Signing is the opposite. We want to restrict who can sign so a private key is used for signing. Remember, signing is like claiming responsibility or approval for a contract. So only the relevant party should be able to sign. Otherwise, we're allowing for forgery. Verifying the signature is not critical. In other words, everyone should be able to verify a signature, hence we use a public key for signature verification. In a public key system, the fact that a private key can only belong to one party gives us the extra benefit of non-repudiation. That is, no party who signed can deny that later, since they're the only party who possess the private key


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.