RSA Sign = Decrypt When Keys Are Shared (Unrestricted Signing Oracle)

Updated 13 Sep 2026

•
What it is
- •
  RSA signing ( $S \equiv m^d \pmod N$ ) and RSA decryption ( $m \equiv c^d \pmod N$ ) are the exact same mathematical operation — both just raise a value to the private exponent $d$ modulo $N$ . If a service exposes an unrestricted "sign anything you send me" endpoint using the same key pair also used to encrypt sensitive data, that signing endpoint doubles as a full decryption oracle: submit the ciphertext as the "message to sign," and the returned "signature" is exactly the decrypted plaintext.
•
When to apply
- •
  A service offers both an encryption/ciphertext-generation feature and a general-purpose signing feature under the same RSA key, with no restriction on what can be submitted for signing (no format check, no "don't sign this" blocklist).
•
Math
- •
  $\text{Sign}(x) = x^d \bmod N = \text{Decrypt}(x)$ — identical operations under the same private key.
•
Worked example
- •
  Fetch a ciphertext $c$ (via any "get_secret"-style endpoint using the target key), then submit $c$ itself to the "sign" endpoint; the returned value is $c^d \bmod N$ — exactly the plaintext.

Python

ciphertext = get_secret()          # c = m^e mod N
plaintext_int = sign(ciphertext)   # returns c^d mod N == m