I'm new to cryptography and please clarify if my below assumption is wrong.

Lets assume, that two different banks creating CSR and they get identical public and private key pairs of RSA. In such scenario, how does the conflict be managed. Will the administrator be notified about the conflict ? will the CA check for the conflict ?

If this persist further, one of the administrator can sniff the packets of the other web server and decipher with copy of his own private key.

  • 1
    $\begingroup$ Using a correctly functioning CSPRNG to generate the keys, the chance of a collision are astronomically small. Pretty much the only way such a thing can happen is a bug, such as an insufficiently seeded PRNG, in which case you have bigger problems than just a collision. $\endgroup$ – CodesInChaos Sep 30 '15 at 9:33
  • $\begingroup$ The numbers and the odds are truly staggering. Just to play with numbers a little as folks sometimes do, one source estimates 10^80 hydrogen atoms in the universe. There are very roughly 10^600 possible moduli N in a 2048 bit key space even allowing for certain constraints on the allowed values of N. The odds of generating the same one twice with an unbroken CSPRNG, even with the birthday paradox in mind, is remote enough that even cautious people can rest easy that no collisions have occurred without trying to check for them. $\endgroup$ – WDS Sep 30 '15 at 11:07
  • $\begingroup$ Meanwhile, in practice, ... eprint.iacr.org/2012/064 $\endgroup$ – Bristol Oct 1 '15 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.