# Is it possible to have identical public keys for different ciphers?

Is it possible (and is there any research I can read) to have 2 key pairs for different ciphers, for example RSA 1024 and some yet to be released EC (or other asymmetric cipher) than uses 1024 bit keys, that have the same public key?

• Sure. $\:$ Just let the ciphertexts for it equal the plaintexts, and let the generation algorithms have non-zero but negligible probabilities of outputting it. $\;\;\;\;$
– user991
May 20, 2015 at 22:45

There's not really a good way to answer your question other than to explain the concepts involved. The answer can be any one of "yes", "no", or "it depends".

Asymmetric encryption algorithms use public keys that have some structure. For instance, RSA public keys are a tuple of $(n,e)$, where $e$ is the exponent, and $n=pq$ for some primes $p$, $q$ unknown to all but the holder of the private key. In modern systems, $n$ will typically be on the order of 2,048 or 4,096 bits. ECC keys, on the other hand, consist of a point $(x, y)$ on an agreed-upon elliptic curve. In typical ECC schemes, each of these points will be on the order of 192, 256, or 384 bits.

Semantically there will not be colliding keys between these algorithms, because the constituent components of these keys have different meanings. On the other hand, it's technically possible (but exceedingly unlikely in practice) to create, say, a 512-bit RSA key whose $(n, e)$ is also a point $(x,y)$ on an elliptic curve used in ECC. Or, whose bit representation of $n||e$ is equal to the bit representation of a point on an elliptic curve $x||y$.

On the other hand, if two different ECC elliptic curves intersect, you could have a point $(x,y)$ that lies at that that intersection and works for both curves. One could also hypothesize the existence of a future cryptosystem that uses public keys of the form $(n,e)$ as RSA does, but isn't RSA.

However, most cryptosystems that handle public/private keys encode the type of key and additional parameters into the public key file, so it's impossible in practice to ever have a public key that will work natively for two different types of cryptosystems.

TL;DR, it's plausible that one could find colliding keys between different ECC schemes. It's not totally inconceivable to find a colliding key between RSA/ECC by either bit representation or by actual colliding $(n,e)=(x,y)$. And it's not out of the question for some new cryptosystem to reuse keys from an existing cryptosystem verbatim. But in practice, no real world software is likely to be able to use an single public key file for more than one cryptosystem.

• Yeah, sorry it was kind of a vague question. This is a great answer though. Thank you! The context is along the lines of could a (serialized) public key be used as a primary key/unique index in a database table. May 21, 2015 at 2:55

Well, it is very rarely the case to have a collision. However it is still possible, especially if the Random Number Generator doesn't generate a good random. There is a group of researchers who are working on this problem you can check it out https://factorable.net

What they found is that

    • We found that 5.57% of TLS hosts and 9.60% of SSH hosts share public keys
in an apparently vulnerable manner, due to either insufficient randomness
during key generation or device default keys
• We were able to remotely obtain the RSA private keys for 0.50% of TLS hosts
and 0.03% of SSH hosts because their public keys shared nontrivial common
factors due to poor randomness.
• We were able to remotely obtain the DSA private keys for 1.03% of SSH hosts
due to repeated signature randomness.