1

Are the private key Serial numbers and thumbprints the same as the corresponding public key Serial numbers and thumbprints for certificates (X509Certificates, Base64-encoded X.509), and are these good fields to compare on?

I am wanting to use this information as part of a validation process for a WCF web service, but want to be sure that both public and private keys hold the same hash or base64 values for comparison.

If these can be different, is there a better certificate field to use to validate?

The client will be signing their messages with their private key and I would be using their public key for the validation.

1 Answer 1

4

Keys and serial numbers are all properties of x509 certificates. Neither private keys not public keys have serial numbers.

However, matching a public key against a private key is surprisingly simple, since the private key contains the public key.

Specifically, both the private key contain a "public Exponent" (usually 0x10001 [65537]) and a "modulus" (a 2048-bit number for 2048-bit keys, typically written as a string of hex bytes).

Since the public exponent is the same for just about all rsa keys, what matters is the modulus. If the modulus on the public key is the same as the modulus on the private key, then the keys match.

In fact, you can take the private key alone and construct the public key just by saving out the modulus and public exponent; that's all there is to a public key. Since the x509 certificate always contains the public key, you're guaranteed that the x509 cert will therefore contain the appropriate modulus and exponent, which you just need to to match with your private key to verify that you have the right one.

2
  • 1
    what about the thumbprints? both my private and public certificates have serial numbers, as a field when I view their properties, also when I access the certificate via C# using the X509Certificate2 object to fetch my certificate from my store there is a serial number property accessible.
    – Sanpopo
    Feb 18, 2014 at 4:37
  • There are no private certificates. Thumbprint is a bit ambiguous, but to the extent that it means a has of the public key, then its as good as the public key for comparisons.
    – tylerl
    Feb 18, 2014 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .