3

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys were identical. I did use the same key size, algorithms, and passphrases as the older set, but I thought that there was supposed to be randomness involved in key generation. Should I be concerned about the state of my computer's rng?

I'm concerned that this question may be getting too personal, but I did not find any information on stackexchange or via search engines so I thought this information might be useful for another individual's later searches. I've often found useful answers lurking on stackexchange and hope this may provide the same to someone down the line.

EDIT:

I used the Seahorse GUI frontend. File > New > GPG > entered passphrase, selected RSA and 4096 > generated keys. I then exported the new key from the 'my keys' tab (recounting this from memory) and double-checked it was a public key. Then I opened properties of the new key, did the complete export, and double-checked that it exported a private key.

I could not reproduce this (generate another key with identical public key), but the old public key did work with the new private key. I do not know the old key id (it was only in use for a week or so). I generated a new key; did not find old key file. The only settings I changed in Seahorse was to increase key size; I did not opt for any deterministic key generation. I don't see how my entropy could be identical.

Improve this question
12
  • 2
    It will be very useful to know the steps you took to generate the key (commands and so on).
    – kiBytes
    Mar 19, 2014 at 9:46
  • 3
    Unless you're deriving your keys from a password with pre-set KDF parameters - if you ever happen to generate the same key as the previous one, you're doing it wrong.
    – BeagleEagle
    Mar 19, 2014 at 9:50
  • 2
    @user12588 - have you tried using your new private as the old private key? In other words, can you use the new private key with your old public key? Have you done a 'diff' on the new and old public keys to make sure they are really the same?
    – Lex
    Mar 19, 2014 at 10:28
  • 1
    It sounds to me that your software was using this random number generator: xkcd.com/221 !Random Numbers
    – avgvstvs
    Mar 19, 2014 at 11:09
  • 1
    Please edit your question to put the additional information from your comments into the question - comments get lost.
    – guntbert
    Mar 19, 2014 at 16:46

1 Answer 1

Reset to default
4

The chances of this happening by chance are zero.

You have either:

  • Found the old private key you thought was lost (hidden file?), or

  • Used a deterministic key generation mode which takes user-supplied entropy (passphrase). If you use the same entropy you will get the same key, or

  • You've got a completely borked install which always returns the same random numbers.

I am not familiar with the Seahorse GUI so I don't really know how likely these options are.

However I think it most likely that you only thought you hade lost the key because you didn't know where it was. I am guessing that Seahorse looked in a bunch of default locations and found it somewhere. By default it's in a hidden directory in your $HOME.

Improve this answer
3
  • I thought the chances of this happening by chance were zero too. Then it happened. Is there no third alternative since the former two seem as unlikely as this happening in the first place?
    – user12588
    Mar 21, 2014 at 19:29
  • @user12588, the only other alternative is that you have a completely borked install which supplies constants for random numbers. I think Number 1 is the most likely now as AFAICT I don't think GPG has the option to do number 2. I think you only thought you had lost the key because you didn't know where it was, but Seahorse (I am guessing) looked in a bunch of default locations and found it.
    – Ben
    Mar 22, 2014 at 7:58
  • Well, I'm very certain this (number 1) is not true because I specifically generated a new key, not loaded a new file. Also, I was using a live system at the time. But thank you for your time in explaining what could've happened; I'll figure out how to give you answer points.
    – user12588
    Mar 25, 2014 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .