Asymmetry between public key and private key: digital signatures use the private key for “encryption”? I have a misunderstanding concerning public key cryptography...would be very helpful if you answer the questions...


Digital signatures: You use your private key for "encryption" and they use your public for "decryption". I thought that you can only decrypt with a private key and encrypt with a public key.. and that's why it is called asymmetric cryptography and this is where all the maths comes in with trapdoor functions and so on....
That's obviously wrong so please explain what I got wrong.
So obviously what I thought in 1) is wrong... so I have read a bit further.
Now I have the impression that private and public key are symmetric in a sense that you can choose one for encryption and then the other one is for decryption but you could also do it the other way round. Then the term "private" and "public" would only refer to which key you publish and which key you keep in secret. What I dont understand here is: Where is the math with trapdoor function used here if it is in a sense completely symmetric?
Is it possible to easily derive the public key from a private key? I have heard that in theory NO but in practice YES...


So I'm a bit confused at the moment, maybe you can help me out here.
You use your private key for "encryption".


That's a common misconception, which has roots in history. The point is that for RSA calculations the signature generation operation uses the same mathematical operation - modular exponentiation - with the private key as the encryption operation with the public key. So in older versions of PKCS#1 - itself called "RSA encryption - this is called "encryption with the private key":


  The data D shall be encrypted with the signer's RSA private key as
     described in Section 7 to give an octet string ED, the encrypted
     data. The block type shall be 01. (See Section 8.1.)


This is also reflected in RSA encryption originally being used as object identifier within X509 certificates, such as those within your browser.

This over-simplification was fixed in PKCS#1 v2 and higher, where the modular exponentiation got a different name: RSASP1 (RSA signature primitive 1) instead of RSAEP (RSA encryption primitive). A primitive here is simply an underlying function within the algorithm, by the way.

Other signature standards such as the Digital Signature Algorithm (DSA) use a specific operation to perform signature generation. This specific operation cannot directly be used for encryption. So there isn't a direct encryption counterpart for DSA. The Integrated Encryption Scheme (IES) can be used but it depends on Diffie-Hellman (DH) rather than DSA. The same goes for the more modern Elliptic Curve implementations (ECDSA, ECIES and ECDH respectively).


  Now I have the impression that private and public key are symmetric in a sense that you can choose one for encryption and then the other one is for decryption but you could also do it the other way round.


Yes, and that's precisely what you should not be thinking, Poncho has given a good answer here. 

But note that if an implementation expects a public key that the operation with a private key may fail. Furthermore, as explained in the last part of the answer, the operation may not be secured for keeping the private key, well, private. And finally it may not use CRT speedup / security either as a public key generally doesn't contain CRT parameters - there is no need and they are not present during key pair generation for the public key.


  What I dont understand here is: Where is the math with trapdoor function used here if it is in a sense completely symmetric?


This is an RSA specific question. It's during the modular exponentiation. The trick is to keep the right exponent (and possibly the parts used during key generation for calculations that use the efficient Chinese Remainder Theorem (CRT) secret.

But please remind that padding is required for a computation using RSA. Just the trapdoor isn't enough; there are certain requirements to make the trapdoor secure.


  Is it possible to easily derive the public key from a private key? I have heard that in theory NO but in practice YES...


I'm not sure about the theory, but if the public key has a large public exponent (e.g. almost the same size as the modulus) then the public key may have as much security as the private key when it comes to the algorithm itself. But there are many reasons why RSA decryption with the public key would still not be secure; e.g. side channel analysis may be performed that the implementation is not protected against (no reason to secure the public key after all). Large public exponents are not common at all and many implementations would even fail if they were to be used.

So you could just test all public exponents, combine them with the modulus and test if an RSA operation is successful. However, in practice the public exponent is simply set at the value 65537 (the fourth prime of Fermat). Besides that, the public exponent is often included in the private key structure as well. So you should not expect to keep the public key secret, period.