Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Why should one not use the same asymmetric key for encryption as they do for signing?

I'm new to IT Security. I still can't figure out why using the same RSA key pair for both (signing and encryption) & (signing and encryption) is a bad idea?

Most people talk about why we should not use same key pair for signing and encryption, but what about signing and decryption?

share|improve this question

marked as duplicate by Rory Alsop May 13 '12 at 21:29

This question was marked as an exact duplicate of an existing question.

Can you reread your question? Your sentences look a bit mangled. – CodesInChaos May 13 '12 at 19:55
@CodeInChaos Yes, I wasn't sure what to make of those, so I left them as is for the OP – jonsca May 14 '12 at 2:05

There's no technical or cryptography-based reason why you wouldn't want to use the same key for both. The only reasons why are:

  • it limits the exposure of your keys -- i.e. you don't have to have the same key available to the people who perform what may be separate tasks
  • ancillary legal reasons -- there might be legal requirements around electronic signatures in your country
  • damage control in the case of compromise -- i.e. if your private key gets out, then the less that key is useful for the fewer problems it will cause
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.