Good practice to separate RSA key pairs used for encryption and digital signatures I've got the following related questions:


If Alice is using the same RSA key pair for both digital signatures and encryption, explain how Bob could forge Alice’s signature on a message of his choice if Alice is ‘foolish’ enough to help him.
What other reasons are there for keeping these key pairs separate?
I can answer this as follows:


If Alice would decrypt a random "ciphertext" for Bob and then return the decrypted message then Alice would have created a signature. Bob simply sends the required input to create a signature by performing modular exponentiation with the private exponent (or CRT parameters, of course). This would however only work for plain/textbook RSA decryption, which is not something you should use in practice.
Key management reasons:

a. You may always want to decrypt your stored ciphertext, but you may not always want to generate signatures with that particular private key.

b. You may not want to make your private key available for the other operations if you only require to perform decryption or signature generation.

c. Flexibility. Maybe you want to put one key pair on a smart card and keep the other in memory. Maybe you don't want to install the signature key on a device that just needs to perform decryption. Protect one with a PIN or password and use the other in an automated environment.