Allow everyone to decrypt a message, but don't allow anyone to encrypt it I would like to create a software that will be installed on multiple clients. I would like to broadcast an encrypted message to all of those clients. Each client should be able to decrypt the message and react to it. However, noone should be able to create such a message that could be decrypted by those clients.

So, I would like to be the only entity that is able to create the encrypted message. At the same time I would like everyone to be able to decrypt the message I have created. I would also like the message to be sent in encrypted form, so digital signature alone won't suffice.

Is it possible with assymetric cryptography, i.e. RSA or ECC?

I know some people encrypt with private keys and decrypt with public keys, but lots of sources specify this approach as insecure/invalid. So, I would like to know what's the proper, secure and valid approach?

Update: edited to provide more context information, because maybe my generalization was confusing. It's not about the network, but rather I'm trying to think of some software registration key scheme. I would have multiple clients. When someone buys a key, I would send this person an encrypted registration info. His copy of the software would read this encrypted key info, decrypt it, and store on the disk in decrypted form. I would like to prevent converting this decrypted form into encrypted form again to prevent registration key from being stolen by some malicious software. The key would be useless in decrypted form because the software wouldn't accept decrypted key; it would accept only encrypted keys.
This is a scenario where your description would be much improved if you explicitly considered the following questions, which you should always ask in cryptography:


Who are the "honest" parties? (See at the bottom for an explanation of the scare quotes.)
Who are the adversaries?


In particular, you've not taken enough care to describe who the adversaries are.  The first obvious thing we can imagine is that there are third parties—neither your software nor its clients, both of whom would count as "honest parties"—that would eavesdrop on the broadcast and would like to know its plaintext.  If that's the model, then a simple solution would be:


All the messages are encrypted with a symmetric algorithm whose key is shared by the broadcaster and all the clients;
The broadcaster signs every broadcast with its own asymmetric keypair, and all clients verify the signature on every broadcast.


But there's a problem with this way of looking at it: should the clients really be modeled as "honest" parties, or are they actually a type of adversary?  Encryption only protects message confidentiality if the recipient is an honest party, who keeps the keys and plaintexts secret.

The problem with your scenario then is that you're disclosing information to another party and expecting them not to disclose it to anybody else.  That works if and only if the other party is "honest," and it could easily fail if the other party is an adversary.



Note that in cryptography, "honest party" is not a moral term.  It's a party to some protocol who can be counted on to execute it faithfully.  While an adversary is a party that cannot be counted on to follow the rules.