Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
Why should one not use the same asymmetric key for encryption as they do for signing?

I'm new to IT Security. I still can't figure out why using the same RSA key pair for both (signing and encryption) & (signing and encryption) is a bad idea?

Most people talk about why we should not use same key pair for signing and encryption, but what about signing and decryption?

share|improve this question

marked as duplicate by Rory Alsop May 13 '12 at 21:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Can you reread your question? Your sentences look a bit mangled. –  CodesInChaos May 13 '12 at 19:55
@CodeInChaos Yes, I wasn't sure what to make of those, so I left them as is for the OP –  jonsca May 14 '12 at 2:05

1 Answer 1

There's no technical or cryptography-based reason why you wouldn't want to use the same key for both. The only reasons why are:

  • it limits the exposure of your keys -- i.e. you don't have to have the same key available to the people who perform what may be separate tasks
  • ancillary legal reasons -- there might be legal requirements around electronic signatures in your country
  • damage control in the case of compromise -- i.e. if your private key gets out, then the less that key is useful for the fewer problems it will cause
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.