Public key decryption mathematical analogy To clarify, I'm talking about digital-signatures, not public key encryption.

When I encrypt something with a private key, then it should be decryptable with a public key, as I've understood how asymetric cryptography works.

So, if 654 * 987 * 123 = 79.396.254, there are countless sums that could lead to that 79 million answer, that explains private key encryption to me, and can be applied to superficially explain how digital signing works.

But how do you verify with a public key, that it was signed with their private key?

I'm looking for the simplest mathematical way to explain this, perhaps using a similar mathematical analogy.

I'm not looking for a super in-depth explanation, but a superficial analogy for it.
Ok, here's a toy example (which really doesn't work) of a simple signature scheme, which you can use as an analogy of a real system:

Suppose the signer Alice picks three integers $b, c, p$, and computes $a = b \times c \bmod p$.  She then publishes $a, b, p$ as her public key, and keeps $c, p$ as her private key.

Then, when Alice wants to sign a message $M$, she computes $S = c \times M \bmod p$, and publishes $S$ as the signature.

So, when verifier Bob gets the message $M$, the signature $S$, and Alice's public key, he verifies whether $a \times M \bmod p$ and $b \times S \bmod p$ are the same; if the signature is valid, then $a \times M \bmod p = (b \times c) \times M \bmod p = b \times (c \times M) \bmod p= b \times S \bmod p\ $, and so equality would hold.

The points I am hoping to make in this analogy:


The signature is not necessarily an 'encoding' of the message
Instead, the signature and the message satisfy some relationship (in concert with the public key)
It's not obvious how to create a signature for a given message with only the public key (actually, my example falls down a bit here)
The private key contains the 'secret sauce' that makes generating such signatures easy


Now, this doesn't work as an actual signature scheme, even with large numbers, because we know how to compute $a \times b^{-1} \bmod p$, which is $c$, however the method isn't immediately obvious to someone new to the field.