Q:

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can:
a) Encrypt the message using your private key, and I can decrypt is using your public key.
b) You can create a digital signature of your message, and then send the signature along with the un-encrypted message.
My two questions are:
1) I read somewhere that in the (a) scenario, if your encrypted message is tampered with en route, I won't be able to decrypt it using your public key. Is this the case? I thought I'd be able to apply your public key to any message, tampered-with or not, and if it's been tampered with, the message might just be gibberish or something.
2) What is the advantage of (b) over (a)? Given that the encrypted message in (a) and the digital signature in (b) are both encrypted using the same private key, in what way is the security provided by (b) better?

A:

These misconceptions come from people trying to explain digital signatures to the layperson. Once someone understands the concept of asymmetric encryption, a common way to explain signatures is "encryption with private key", but in reality there is no such thing (for a very technical explanation, see here). You're far better off thinking of asymmetric encryption and digital signatures as two entirely separate things.
You've come across some of the many problems with this explanation. If someone did try to send you a message "encrypted" with their private key and it was tampered with, you are correct that you would be able to "decrypt" it, but it would be gibberish.
In practice though, messages are too long to be encrypted or signed directly with asymmetric cryptography. When encrypting, a symmetric key is usually generated and used to encrypt the data, then that key is encrypted asymmetrically with the recipient's public key.
Likewise, when signing, the message is first passed through a digest algorithm (cryptographic hash) to remove any structure in the data and to output a small digest that is then signed with the private key. Even if you only have a very short message to sign though, you must still pass it through a hash, otherwise an attacker may be able to forge signatures on random messages algebraically related to yours.
Since correct signing requires some sort of hashing to be used, the signature obviously can't be reversed to the original message, so the message also has to be sent separately to the recipient (consequently your (a) scenario isn't even possible). Often, messages are signed with the sender's private key, then encrypted with a random symmetric key, which itself is then encrypted with the recipient's public key.

