Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In common RSA encryption, a public key is used to encrypt message, and private key decrypts it. However, in digital signing, it's the other way around: Bob hashes his message, then encrypts the hash with his own private key, Alice uses Bob's public key to decrypt the encrypted hash.
What is the purpose of this opposition? Or It doesn't matter which key to encrypt/decrypt?
In asymmetric cryptography, it does matter which key we use to encrypt and which key we use to decrypt. From a high level, we want everybody to be able to encrypt so a public key is used for encryption. But we only want a certain party to decrypt (usually the party who created the key pair) so a private key is used for decryption. In other words, in the case of encryption/decryption, it's decryption that is the critical operation since it exposes what we're trying to hide - the plaintext.
Signing is the opposite. We want to restrict who can sign so a private key is used for signing. Remember, signing is like claiming responsibility or approval for a contract. So only the relevant party should be able to sign. Otherwise, we're allowing for forgery. Verifying the signature is not critical. In other words, everyone should be able to verify a signature, hence we use a public key for signature verification. In a public key system, the fact that a private key can only belong to one party gives us the extra benefit of non-repudiation. That is, no party who signed can deny that later, since they're the only party who possess the private key
