About digital signatures. Are they really secure? [closed]

Question

Let's suppose I want to send you an encrypted and signed message, to demonstrating authenticity and integrity, together with the natural security of asymmetric key cryptography. The procedure is, if I'm not wrong, the following one:

• I create a message I want to send you.
• I generate a hash version of that message (the digest).
• I encrypt the digest with my private key.
• I send you a composed message consisting of the message, the encrypted digest and my public key, in a secure way (for example, encrypting again the complete package with your public key).
• You receive and decrypt the package with your private key, and decrypt the digest with the attached public key. If decryption finishes successfully, you ensure my authenticity, because I'm the only person who can has that private key.
• You generate again the hash version of the attached message to check integrity, because if digests agree, means the message was not corrupted on the way.

But in such case, if you decrypt the message with my public key, you can decrypt the message and, about getting my private key, isn't it easier now?

The reason of encrypting a message to you with your public key, is because a sniffer hasn't the other "factor" (ok, I know the public key is the combination of two huge prime numbers and a third prime number, and the private key is a module arithmetic based key, based on these three prime numbers; but let's me call them "the two factors" for simplicity).

But if both factors comes "together" and there's no risk at all, what would be the reason of keeping the private key in secret?

Answer 1

You were on the right track, until "and, obviously, get my private key".

There's a lot of mathematics that goes into how the keys operate.

The way public/private keypairs work is that with the public key, you can verify the matching private key was used, without ever knowing what the private key is. From having the public key, there's no easy way to figure out the private key.

The signature proves that someone who knew the entire private key signed the file. The public key is used only to verify that signature is valid and that the message hasn't been altered or replaced. They can also be used the other way around - using the public key to encrypt a message to you, only the person who knows the private key can decrypt and read it.

The entire public/private key system is setup to make it easier to communicate without an existing secure channel. You can publish the public key far and wide to everyone who might want it, without compromising the private key.

Answer 2

When you encrypt plain-text with a private key, then you can decrypt cipher-text with the public key. Only one person should have the private key. The entire world has access to the public key.

When you have cipher text decrypted by the public key, you only get the plain-text back - the private key is still private as you did not obtain that.