# What happens if two parties have a same pair of public&private keys

we know that we have to create Private key on server and generate its public key and create a certificate.
But what if we get a private key which someone already has. Isn't the security becomes weak in this case.

Simple explanation

The only way this will ever happen is if you give someone your private key. It will never happen by random chance. Never. You'd have a better chance of winning the lottery twice, getting struck by lightning and being mauled by two gorillas all in the same day. Instead of worrying about generating a private key that someone already has, you'd be better off worrying about how to protect yourself from lightning and gorillas so you can spend the money you'll win in the lottery.

Scientific Reasoning

Let's say you are dealing with 1024-bit RSA for your public key system. A good key generator will choose the two 512-bit primes independently, so the probability that any two instantiations of the key generator will choose the two primes necessary for RSA is 2-512 · 2-512 = 2-1024 or about 1/10308. That number is so astronomically small that there is no way it will happen in a properly functioning system. Your odds of being struck by lightning in a given year (forget on a given day) 1/1,000,000 (1/106). Probability of getting mauled by two gorillas 2-120 (see post in Rory's comment). The lottery one is a little harder as it depends on what lottery (as the odds are different for every one), but hopefully you get the point.

Improper System

All bets are off. As pointed out in Jeff's comment, this happened in Debian's version of OpenSSL due to a simple bug which caused the random number generator to be seeded with very little randomness. The result was that people could potentially have the same private keys.

Having the same private key as someone else would allow those two people to decrypt each other's messages, etc.

• thanks for the answer. Private key is generated by some program on server. Is there any chance it will generate the same private&public key for 2 users? Commented Dec 12, 2011 at 13:56
• +1 for the amusing statistical commentary, but be aware that it has happened before because of a bad generator. wiki.debian.org/SSLkeys#How_weak.3F Commented Dec 12, 2011 at 14:38
• added link to @Thomas' gorilla example on crypto Commented Dec 12, 2011 at 15:10
• I hate to say it, but this doesn't actually answer the question. Commented Dec 12, 2011 at 15:57
• @GeorgeCummins, I've added more detail. Hopefully that better shows my point. Commented Dec 12, 2011 at 20:19

If someone gets access to your private key, he can decrypt messages encrypted for you and sign messages in your name. So he basically can do everything, you can do with the key pair.

Although there had been bugs in the past, it is reasonable unlikely that someone else will generate the same key pair.

The main risk is, that the private key gets stolen by malicious software on the computers the key is stored on. You mentioned, that you do not generate the key pair locally, but on a server. This allows the administrators of that server to access your private key.

While the key might be protected with a passphrase, malicious software may replace the key handling applications or sniff keyboard input.