> its possible to encrypt with the private key and decrypt with the public key
Isn't it just signing/verifying? I.e. "encryption" with a private key is how RSA is being used to sign, and "decryption" with a public key - used to verify the signature.
Isn't it just signing/verifying? I.e. "encryption" with a private key is how RSA is being used to sign, and "decryption" with a public key - used to verify the signature.
It would seem odd, however, that client -> server is encrypted but unsigned whereas server -> client is signed but unencrypted. My guess, for what it’s worth, is that somebody at the company insisted that all comes must be encrypted and so they cobbled this together along with the obfuscation of the public key the author describes.