Vtgyjfy

Lets say we use RSA as the signature method.

Alice wants to send a message to Bob and uses RSA signing. For that she signs her message with her private key. But everybody could now have access to her message if one just decrypts the signature with Alice's public key.

What is the point of digital signatures if confidentiality is violated?

Digital signatures are not designed for confidentiality. The simplest counterexample to the implicit conclusion that there is no point to digital signatures without confidentiality, consider the use of PGP signatures. People may sign a message that they send to a public mailing list, allowing others to verify that they indeed said that and not an imposter pretending to be them.

Also, you seem to be misunderstanding how digital signatures work. It is not encryption that you decrypt to verify. A digital signature is a mathematical operation on a hash of the message. That you verify is valid for the message. You don't recover the message from the signature.

Consider the paper-based analogy:

[Alice] signs her message m with [her] private key.

Similarly, Alice signs a document on paper with her signature.

everybody could now have access to her message if one just [verifies] the signature with Alice's public key.

And everyone who has access to the document, can verify that Alice has signed the document.

In practice, they'll need some way to know what Alice's signature looks like (or what their public key is), and not everyone can do that, just those who get a copy of the document.

The bottom line is that signatures provide only authentication, not privacy. Privacy has to be handled separately, with encryption, or with trusted couriers and safes or such.

You don't encrypt the message with your private key.

The point of digital signatures is for verifying the authenticity of the message.

Simplified: You create a hash of the message $H(m)$ and then sign the hash $S(H(m))$. This is then appended to the message and finally both are sent to the receiver.

The message is usually still encrypted with the receiver's public key, so that only the receiver can decrypt the message with his private key.

As other users have correctly stated, signing is to ensure message integrity, not confidentiality.

Note that it is possible to encrypt a message first, then sign it.

This will protect the confidentiality of the message, and even if it is compromised, you will still be able to protect against 'man in the middle' attacks by verifying the signature.

To provide some additional context for the information provided in the other answers.

It is true that RSA is used to encrypt / decrypt information

However:

In almost all real-world cases RSA is not used to encrypt a large message being exchanged but rather just used to encrypt the hash of the message (this is signing / creating a signature for the message)

As other answers point out, this makes it possible for the receiver to know with certainty that the message has not been tampered with by some intermediary.

The steps are (a bit simplified for illustration purposes):

1. Alice creates message for Bob


2. Alice creates a hash for the message


3. Alice encrypts the hash value using her private key - this 'encrypted hash value' is the signature for the message


4. Alice sends the message, in clear text, plus the signature (encrypted hash value) to Bob


5. Bob creates a hash for the message (using the same hash algorithm as Alice used in step 2)


6. Bob decrypts the encrypted hash value provided by Alice, using Alice's public key


7. Bob compares his hash value for the message (from step 5) with the decrypted hash value (from step 6)

If the two hash values compared in step 7 are the same, Bob knows with certainty that the signature was created by Alice (since only she has access to her private key) and that the message he received was exactly how Alice authored it, i.e. no one has made changes to the message.

On the topic of confidentiality, encrypting the message itself is almost always done using an encryption algorithm other than RSA (since RSA is slow and optimized for encrypting small information sets). This can be accomplished many different ways but one option is to add to the steps:

1. Alice creates message for Bob


2. Alice encrypts the message using a symmetric key encryption algorithm using key of her choosing that only she knows


3. Alice encrypts the symmetric key using Bob's public key and adds it to the end of the message


4. Alice creates a hash for the message


5. Alice encrypts the hash value using her private key - this 'encrypted hash value' is the signature for the message


6. Alice sends the encrypted message, plus the signature (encrypted hash value) to Bob


7. Bob creates a hash for the message (using the same hash algorithm as Alice used in step 4)


8. Bob decrypts the encrypted hash value provided by Alice, using Alice's public key


9. Bob compares his hash value for the message (from step 7) with the decrypted hash value (from step 8)


10. If the hashes match, Bob takes the encrypted symmetric key value from the end of the message and decrypts it using his secret key


11. Bob decrypts the encrypted message using the same symmetric encryption algorithm Alice used in step 2, using the symmetric key value from step 10

With these steps Bob knows Alice authored the message and only he is able to decrypt it since the symmetric key used to encrypt the message was encrypted using his public key. I.e. only Bob is able to get the symmetric key value since only he has access to his private key.