RSA can do two things: encrypt data and sign messages. Both use the same underlying math, but they use different keys, different padding, and serve different purposes. Mixing them up is not just a theoretical concern, it can lead to real security vulnerabilities.
Let's break down the difference and why it matters.
Encryption: Confidentiality
The purpose of encryption is confidentiality. You want to ensure that only the intended recipient can read the message.
**How it works:** - The sender encrypts the message using the recipient's **public key**. - The recipient decrypts the message using their **private key**. - Anyone can encrypt (because the public key is public), but only the recipient can decrypt.
**The flow:** 1. Alice wants to send a confidential message to Bob. 2. Alice encrypts the message using Bob's public key. 3. Alice sends the ciphertext to Bob. 4. Bob decrypts the ciphertext using his private key. 5. Only Bob can read the message.
**Padding:** RSA encryption uses OAEP (Optimal Asymmetric Encryption Padding) or PKCS1 v1.5 padding. These add randomness and structure to the plaintext before encryption to prevent attacks. We cover this in detail in our RSA padding guide.
Signing: Authenticity and Integrity
The purpose of signing is authenticity and integrity. You want to prove that the message came from a specific sender and was not tampered with.
**How it works:** - The sender signs the message using their **private key**. - The recipient verifies the signature using the sender's **public key**. - Only the sender can sign (because the private key is secret), but anyone can verify.
**The flow:** 1. Alice wants to prove she wrote a message. 2. Alice hashes the message and signs the hash using her private key. 3. Alice sends the message and the signature to Bob. 4. Bob hashes the message and verifies the signature using Alice's public key. 5. If verification succeeds, Bob knows the message is from Alice and was not modified.
**Padding:** RSA signing uses PSS (Probabilistic Signature Scheme) or PKCS1 v1.5 signature padding. These are different from encryption padding schemes and are designed for the specific requirements of signatures.
The Mathematical Relationship
Both encryption and signing use the same RSA operation: modular exponentiation. The difference is which key is used:
- **Encryption**: ciphertext = message^e mod n (using public exponent e) - **Decryption**: message = ciphertext^d mod n (using private exponent d) - **Signing**: signature = hash^d mod n (using private exponent d) - **Verification**: hash == signature^e mod n (using public exponent e)
Notice that signing uses the same operation as decryption (both use d), and verification uses the same operation as encryption (both use e). This is because RSA is based on a trapdoor permutation: applying e and then d (or d and then e) gives you back the original value.
This mathematical relationship is why mixing encryption and signing is dangerous. If you use the same key pair for both, an attacker can sometimes trick your system into treating a decryption operation as a signing operation, or vice versa.
Why You Should Not Mix Keys
Using the same RSA key pair for both encryption and signing creates several attack vectors:
**Bleichenbacher-style attacks on signatures:** If your system uses the same key for encryption and signing, an attacker can take a ciphertext they want to decrypt, send it to your system as a "message to sign," and get back the decrypted ciphertext as the "signature." This is because signing and decryption use the same mathematical operation (exponentiation with d).
**Replay attacks:** A signature created for one purpose could be repurposed as a decryption of a ciphertext, or vice versa. Using separate keys ensures that a signature is always a signature and a ciphertext is always a ciphertext.
**Key compromise scope:** If your signing key is compromised, the attacker can forge signatures but cannot decrypt messages. If your encryption key is compromised, the attacker can decrypt messages but cannot forge signatures. With separate keys, a single compromise does not grant both capabilities.
**Compliance requirements:** Most security standards (FIPS 140-2, Common Criteria, PCI DSS) require separate keys for encryption and signing. Using the same key can cause compliance failures.
The Right Way: Separate Keys
The best practice is to use separate RSA key pairs for encryption and signing:
- **Encryption key pair**: Public key for encrypting, private key for decrypting. - **Signing key pair**: Private key for signing, public key for verifying.
These key pairs should be generated independently, stored separately, and rotated on different schedules. This way, a compromise of one does not affect the other.
In practice, most systems already do this. TLS certificates use one key pair for the handshake (which involves signing). PGP uses separate subkeys for encryption and signing. JWT systems that use RS256 have a signing key pair that is not used for encryption.
PSS vs OAEP: Different Padding for Different Jobs
Even the padding schemes are different:
**RSA-OAEP** is for encryption. It takes a plaintext message, adds random padding, and produces a ciphertext that is secure against chosen-ciphertext attacks. OAEP is the modern standard for RSA encryption.
**RSA-PSS** is for signing. It takes a hash of the message, adds random salt, and produces a signature that is secure against chosen-message attacks. PSS is the modern standard for RSA signing.
These padding schemes are not interchangeable. Using OAEP padding for signing or PSS padding for encryption would produce incorrect results. This is another reason why the same key should not be used for both: the padding is specific to the operation.
Practical Recommendations
1. **Use separate key pairs** for encryption and signing. Generate them independently. 2. **Use RSA-OAEP** for encryption. Do not use PKCS1 v1.5 for new applications. 3. **Use RSA-PSS** for signing. It is the modern standard and is provably secure. 4. **Never use the same key for both operations.** This is a well-known vulnerability. 5. **Rotate keys independently.** Your encryption key and signing key should have different rotation schedules.
The Bottom Line
RSA encryption and RSA signing use the same math but serve opposite purposes. Encryption provides confidentiality (public key encrypts, private key decrypts). Signing provides authenticity (private key signs, public key verifies). Using the same key for both is a security vulnerability that can allow attackers to convert one operation into the other.
Use separate keys, use the right padding (OAEP for encryption, PSS for signing), and never mix the two. For more details, read our RSA encryption explained guide and our RSA padding guide. You can also try both operations with our RSA Encrypt/Decrypt tool.
