# Can a public key be used to decrypt a message encrypted by the corresponding private key?

From what I have seen about usage of a pair of public and private keys, the public key is used for encrypting a message, and the private key is used for decrypting the encrypted message.

If a message is encrypted by the private key, can it be decrypted by the corresponding public key?

If yes, can you give some examples of when this case is used?

Thanks.

– D.W.
Jun 15, 2016 at 21:57
• Why would you encrypt it at all if the decryption key was public? Jun 16, 2016 at 1:16
• @Bergi Digital signature? Jun 16, 2016 at 7:41
• @Bergi: The long answer: By encrypting a message with your private key in a way that can be decrypted with your public key, you can send a message that can be read by anyone but can only have been written by you. By encrypting with your private key first and then with the receiver's private key, you create a message that can only be decrypted by the intended receiver, and can only have been written by you. Apr 6, 2017 at 22:14
• @gnasher729 I think you meant encrypting with your private key first and then with the receiver's public key. You aren't supposed to have somebody else's private key Feb 11, 2019 at 9:34

Q: If you pedal backwards on a fish, does it go backwards?
A: ???

A fish is not a bicycle. Similarly, you cannot use a private key to encrypt a message or a public key to decrypt a message. They don't have the right equipment.

With RSA, which is a popular public-key cryptosystem but not the only one, the private key and the public key have the same mathematical properties, so it is possible to use them interchangeably in the algorithms. (They don't have the same security properties, however — the public key is usually easily guessable from the private key.) You can take an RSA encryption algorithm and feed it a private key, or an RSA decryption algorithm and feed it a public key. However, the results are not meaningful according to standard algorithms.

This symmetry between public keys and private keys does not extend to most other public-key cryptosystems. In general, the public key isn't the right type of mathematical object to use for the decryption algorithm, and the private key isn't the right type of mathematical object to use for the encryption algorithm.

This being said, public-key cryptosystems are based on the concept of trapdoor functions. A one-way function is a function that is easy to compute, but whose inverse is hard to compute. A trapdoor function is like a one-way function, but there is a “magic” value that makes the inverse easy to compute.

If you have a trapdoor function, you can use it to make a public-key encryption algorithm: going forward (in the easy direction), the function encrypts; going backward (in the hard direction), the function decrypts. The magic value required to decrypt is the private key.

If you have a trapdoor function, you can also use it to make a digital signature algorithm: going backward (in the hard direction), the function signs; going forward (in the easy direction), the function verifies a signature. Once again, the magic value required to sign is the private key.

Trapdoor functions generally come in families; the data necessary to specify one particular element of the family is the public key.

Even though public-key encryption and digital signatures are based on the same concepts, they are not strictly identical. For example, the RSA trapdoor function is based on the difficulty of undoing a multiplication unless you already know one of the factors. There are two common families of public-key encryption schemes based on RSA, known as PKCS#1 v1.5 and OAEP. There are also two common families of digital signature schemes based on RSA, known as PKCS#1 v1.5 and PSS. The two “PKCS#1 v1.5” are of similar designs, but they are not identical. This answer by Thomas Pornin and this answer by Maarten Bodewes go into some details of the difference between signature/verification and decryption/encryption in the case of RSA.

Beware that some layman presentations of public-key cryptography masquerade digital signature and verification as decryption and encryption, for historical reasons: RSA was popularized first, and the core operation of RSA is symmetric. (The core operation of RSA, known as “textbook RSA”, is one of the steps in an RSA signature/verification/encryption/decryption algorithm, but it does not constitute in itself a signature, verification, encryption or decryption algorithm.) They are symmetric from the 10000-foot view, but they are not symmetric once you go into the details.

See also Reduction from signatures to encryption?, which explains that you can build an encryption scheme from a signature scheme, but only under certain conditions.

• +1 for clearly explaining a misconception I didn't even know I had when I clicked on this question. Jun 16, 2016 at 8:23
• Thanks. "the public key isn't the right type of mathematical object to use for the decryption algorithm, and the private key isn't the right type of mathematical object to use for the encryption algorithm." Do you mean they still can be used for those purposes, but are not good options, or they can't be? What mathematical properties that decide that they aren't the "right" type, besides security properties (e.g. asymmetry in hardness to guess one key from the other)?
– Tim
Jun 17, 2016 at 11:29
• Would cut out the first two paragraphs but otherwise this is a very insightful answer. I came here from a layman's explanation of encryption/decryption and signature/verification and how the private key could be used to "encrypt", and your answer clarified exactly what I was wondering. Feb 23, 2017 at 12:02
• So is this article incorrect: globalsign.com/en/blog/how-do-digital-signatures-work? It mentions that a public key is used for decryption and the private key is used for encryption Dec 6, 2019 at 15:23
• @KennethWorden It's mostly correct, but gets some of the details wrong. Under “Applying the Signature”, “the hash is encrypted” should be “the hash is signed”, and that alone makes the digital signature. And under “Verifying the Signature”, there's no such thing as a “decrypted hash”: for most signature schemes, you can't get the hash back from the signature, what happens instead is that there's a different mathematical operation (called verification) which takes the hash and the signature as inputs and outputs “ok” or “bad”. Dec 6, 2019 at 16:34

Yes, a message which has encrypted using private key can be decrypted using the public key.

In fact, this is implemented to verify the authenticity of the data. In the digital signature, a person encrypts the hash of the data with his private key. Anyone can decrypt the same with the available public key of the person and verify the authenticity of the data.

• You can do this with the RSA cryptosystem, but not with all public key cryptosystems. The El-Gamal crypto-system is different from the El-Gamal signature scheme, for example. See also Gilles' answer Feb 13, 2019 at 16:20
• True that. I was trying to give straight forward answer irrespective of particular algorithms @Discretelizard Feb 17, 2019 at 6:22
• Thank you for giving a straight forward answer. Dec 5, 2019 at 0:46

When the PKE scheme uses a trapdoor permutation as a black box, "encrypting" with the private key followed by "decrypting" with the public key will yield the original message. ​ For other PKE schemes, one can't necessarily even make sense of that. ​ (For example, trying to "encrypt" with the private key might be a type error.)

[Encrypting a message "by the private key" followed by decryption "by the corresponding public key"] is used when people think that case is for digital signatures and are not corrected in time. ​ See this answer and this question.

• No. You are perpetuating the myths that textbook RSA is the only public-key cryptosystem and that signature is the same thing as decryption. Jun 15, 2016 at 16:58
• The former is an excellent point, which I will fix. ​ Is the latter part of your comment due to my long sentence not being clear enough? ​ ​ ​ ​
– user12859
Jun 15, 2016 at 17:03
• I don't understand what you mean by “when people think it's for digital signatures”. It looks like you're saying that people erroneously believe that digital signatures are different from public-key encryption. Coming from you I'm sure this isn't what you meant, but your answer is really confusing, even after adding the first paragraph. Jun 15, 2016 at 17:55

Substitute plaintext data for the trunk and cryptographic keys for the physical keys from this analogy, and this is how public key cryptography works. Only the owner of the private key can encrypt data so that the public key decrypts it; meanwhile, anyone can encrypt data with the public key, but only the owner of the private key can decrypt it.

This is from cloudflare.

Think of the the public key in a asymmetric encryption as a lock instead of a key. Would the hacker who have a lock and a locked box with that lock, unlock the locked box? Of course no, and to unlock that box you need the lock key. Which was never sent in public, and only the sender has it.

However, the answer is Yes :D it's actually possible for a hacker to decrypt the message using only the public key (lock and a locked box). But that's extremely hard for any computer today. Because reverting that encrypted message using that public key is a very hard mathematical operation especially when that key is as large as 2048-bit number. The strength of the mathematical operation relies on the hardness of the prime factorization of a large number.

Here's a good video explaining how the RSA algorithm works https://www.youtube.com/watch?v=wXB-V_Keiu8

The question is valid in terms of eMRTD where AA Public Key is used to de-crypt the Internal Authenticate response encrypted by the eMRTD Private Key. It is part of ICAO 9303 Standard.