Can I save space for short messages by using encryption with private key instead of a signature? Let's say I have a message, a Private Key and a Public Key.

Normally if you want to see if the message is unaltered and is from the sender you would have the message part + signature part, which you can verify using the senders Public key.

This will lead to some extra data, which I want to work around

[ message (1 kb) ] [ verification part (?? bytes) ]

My solution to this problem is to encrypt the message using the private key, and to decrypt it using the public key.

This way it should be certain that:


The message is unaltered
The message is really from the sender


In short:

Sender:
Encrypt Message using Private Key

Receiver:
Decrypt Message using Public Key

Is this safe? So is this a way to:


Check the senders identity (is it really from the sender (is it really signed by the Private Key))
The message is unaltered
In general, no.

First, with an arbitrary public key scheme, the public and private keys might have quite different formats, and there might be no such thing like "encryption with a private key".

For example, with (generic) ElGamal, the public key is a member of the group, the private key is a natural number used as exponent.

With RSA, the public and private keys both consist of the same modulus, and additionally a public or private exponent. (The public exponent is usually something small like $3$ or $2^{16}+1$, while the private exponent is of the same order as the modulus.) The core of an encryption or decryption operation is a modular exponentiation with the (public or private) exponent, and yes, this part is easily swapped around, so you can use a private exponent for something which resembles encryption (and you then can use the decryption operation with the public key to undo it). And as is known, the core of the RSA signature operation is just this exponentiation with the private exponent, while verification uses the exponentiation with the public exponent.

Note that this is not a secure use of encryption, i.e. does not provide confidentiality. Does it provide integrity and authentication?

Real live RSA is not only the core exponentiation operation, but additionally a padding operation, to destroy homomorphic properties. There are several padding schemes, both randomized and deterministic, but these padding schemes are different for signature and encryption, for a reason.

Note also that usually public-key encryption is used in a hybrid scheme: encrypt a random symmetric key using the public key algorithm, then encrypt the actual message using the symmetric key. The resulting message thus will have this format:

[ encrypted key ][ encrypted message ]


The encrypted key has (for RSA) a size same as the modulus (which is the same as a signature), the message itself will have about the size of the plaintext message (maybe also including some padding, and hopefully a MAC). This means you will not save anything compared to the standard signature scheme.

What you actually need is a signature with message recovery, i.e. a signature from which (the unknown part of) the signed message can be extracted.
But this only works (or saves space) for a message which is small enough to fit in the signature (and often a bit smaller due to overhead), so for your 1 KB message you would need an RSA key of similar size. I suppose these schemes are only useful for small messages, like in implicit certificates, where the message is the public key to be certified.