Private Key and Public Key Serial Number and Thumbprints

Question

Are the private key Serial numbers and thumbprints the same as the corresponding public key Serial numbers and thumbprints for certificates (X509Certificates, Base64-encoded X.509), and are these good fields to compare on?

I am wanting to use this information as part of a validation process for a WCF web service, but want to be sure that both public and private keys hold the same hash or base64 values for comparison.

If these can be different, is there a better certificate field to use to validate?

The client will be signing their messages with their private key and I would be using their public key for the validation.

Answer 1

Keys and serial numbers are all properties of x509 certificates. Neither private keys not public keys have serial numbers.

However, matching a public key against a private key is surprisingly simple, since the private key contains the public key.

Specifically, both the private key contain a "public Exponent" (usually 0x10001 [65537]) and a "modulus" (a 2048-bit number for 2048-bit keys, typically written as a string of hex bytes).

Since the public exponent is the same for just about all rsa keys, what matters is the modulus. If the modulus on the public key is the same as the modulus on the private key, then the keys match.

In fact, you can take the private key alone and construct the public key just by saving out the modulus and public exponent; that's all there is to a public key. Since the x509 certificate always contains the public key, you're guaranteed that the x509 cert will therefore contain the appropriate modulus and exponent, which you just need to to match with your private key to verify that you have the right one.