we know that we have to create Private key on server and generate its public key and create a certificate.
But what if we get a private key which someone already has. Isn't the security becomes weak in this case.

2 Answers 2


Simple explanation

The only way this will ever happen is if you give someone your private key. It will never happen by random chance. Never. You'd have a better chance of winning the lottery twice, getting struck by lightning and being mauled by two gorillas all in the same day. Instead of worrying about generating a private key that someone already has, you'd be better off worrying about how to protect yourself from lightning and gorillas so you can spend the money you'll win in the lottery.

So as long as you keep your private key private, you will never have to worry about this.

Scientific Reasoning

Let's say you are dealing with 1024-bit RSA for your public key system. A good key generator will choose the two 512-bit primes independently, so the probability that any two instantiations of the key generator will choose the two primes necessary for RSA is 2-512 · 2-512 = 2-1024 or about 1/10308. That number is so astronomically small that there is no way it will happen in a properly functioning system. Your odds of being struck by lightning in a given year (forget on a given day) 1/1,000,000 (1/106). Probability of getting mauled by two gorillas 2-120 (see post in Rory's comment). The lottery one is a little harder as it depends on what lottery (as the odds are different for every one), but hopefully you get the point.

Improper System

All bets are off. As pointed out in Jeff's comment, this happened in Debian's version of OpenSSL due to a simple bug which caused the random number generator to be seeded with very little randomness. The result was that people could potentially have the same private keys.

Having the same private key as someone else would allow those two people to decrypt each other's messages, etc.

  • thanks for the answer. Private key is generated by some program on server. Is there any chance it will generate the same private&public key for 2 users?
    – Sampath
    Commented Dec 12, 2011 at 13:56
  • 5
    +1 for the amusing statistical commentary, but be aware that it has happened before because of a bad generator. wiki.debian.org/SSLkeys#How_weak.3F
    – Jeff Ferland
    Commented Dec 12, 2011 at 14:38
  • 1
    added link to @Thomas' gorilla example on crypto
    – Rory Alsop
    Commented Dec 12, 2011 at 15:10
  • 2
    I hate to say it, but this doesn't actually answer the question.
    – Steve
    Commented Dec 12, 2011 at 15:57
  • 1
    @GeorgeCummins, I've added more detail. Hopefully that better shows my point.
    – mikeazo
    Commented Dec 12, 2011 at 20:19

If someone gets access to your private key, he can decrypt messages encrypted for you and sign messages in your name. So he basically can do everything, you can do with the key pair.

Although there had been bugs in the past, it is reasonable unlikely that someone else will generate the same key pair.

The main risk is, that the private key gets stolen by malicious software on the computers the key is stored on. You mentioned, that you do not generate the key pair locally, but on a server. This allows the administrators of that server to access your private key.

While the key might be protected with a passphrase, malicious software may replace the key handling applications or sniff keyboard input.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .