Let's suppose I want to send you an encrypted and signed message, to demonstrating authenticity and integrity, together with the natural security of asymmetric key cryptography. The procedure is, if I'm not wrong, the following one:
- I create a message I want to send you.
- I generate a hash version of that message (the digest).
- I encrypt the digest with my private key.
- I send you a composed message consisting of the message, the encrypted digest and my public key, in a secure way (for example, encrypting again the complete package with your public key).
- You receive and decrypt the package with your private key, and decrypt the digest with the attached public key. If decryption finishes successfully, you ensure my authenticity, because I'm the only person who can has that private key.
- You generate again the hash version of the attached message to check integrity, because if digests agree, means the message was not corrupted on the way.
But in such case, if you decrypt the message with my public key, you can decrypt the message and, about getting my private key, isn't it easier now?
The reason of encrypting a message to you with your public key, is because a sniffer hasn't the other "factor" (ok, I know the public key is the combination of two huge prime numbers and a third prime number, and the private key is a module arithmetic based key, based on these three prime numbers; but let's me call them "the two factors" for simplicity).
But if both factors comes "together" and there's no risk at all, what would be the reason of keeping the private key in secret?