Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

we know that we have to create Private key on server and generate its public key and create a certificate.
But what if we get a private key which someone already has. Isn't the security becomes weak in this case.

share|improve this question

2 Answers 2

up vote 19 down vote accepted

Simple explanation

The only way this will ever happen is if you give someone your private key. It will never happen by random chance. Never. You'd have a better chance of winning the lottery twice, getting struck by lightning and being mauled by two gorillas all in the same day. Instead of worrying about generating a private key that someone already has, you'd be better off worrying about how to protect yourself from lightning and gorillas so you can spend the money you'll win in the lottery.

So as long as you keep your private key private, you will never have to worry about this.

Scientific Reasoning

Let's say you are dealing with 1024-bit RSA for your public key system. A good key generator will choose the two 512-bit primes independently, so the probability that any two instantiations of the key generator will choose the two primes necessary for RSA is 2-512 · 2-512 = 2-1024 or about 1/10308. That number is so astronomically small that there is no way it will happen in a properly functioning system. Your odds of being struck by lightning in a given year (forget on a given day) 1/1,000,000 (1/106). Probability of getting mauled by two gorillas 2-120 (see post in Rory's comment). The lottery one is a little harder as it depends on what lottery (as the odds are different for every one), but hopefully you get the point.

Improper System

All bets are off. As pointed out in Jeff's comment, this happened in Debian's version of OpenSSL due to a simple bug which caused the random number generator to be seeded with very little randomness. The result was that people could potentially have the same private keys.

Having the same private key as someone else would allow those two people to decrypt each other's messages, etc.

share|improve this answer
1  
Thanks again for reply. This explains it better. –  Sampath Dec 12 '11 at 14:01
5  
+1 for the amusing statistical commentary, but be aware that it has happened before because of a bad generator. wiki.debian.org/SSLkeys#How_weak.3F –  Jeff Ferland Dec 12 '11 at 14:38
1  
added link to @Thomas' gorilla example on crypto –  Rory Alsop Dec 12 '11 at 15:10
1  
I hate to say it, but this doesn't actually answer the question. –  Steve Dec 12 '11 at 15:57
1  
@GeorgeCummins, I've added more detail. Hopefully that better shows my point. –  mikeazo Dec 12 '11 at 20:19

If someone gets access to your private key, he can decrypt messages encrypted for you and sign messages in your name. So he basically can do everything, you can do with the key pair.

Although there had been bugs in the past, it is reasonable unlikely that someone else will generate the same key pair.

The main risk is, that the private key gets stolen by malicious software on the computers the key is stored on. You mentioned, that you do not generate the key pair locally, but on a server. This allows the administrators of that server to access your private key.

While the key might be protected with a passphrase, malicious software may replace the key handling applications or sniff keyboard input.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.