# Can a public key be same as private key?

As I understand, we choose the public and private keys to be mutual inverses. However, it is possible that, in a group, there can be numbers which are their own inverses. E.g. Consider p = 7, q = 3. n = 21, phi(n) = 12. For the group G = {s | gcd(s,21) = 1} there are four numbers 1, 8, 13 and 20 which are their own inverses.

In such a case, it is possible to choose these numbers as both private and public keys. Isn't it?

Let me know if I have understood this correctly.

• You seem to be specifically discussing RSA, and not looking at how keys are generated. There are other public-key cryptosystems where the dissymmetry between private keys and public keys is more obvious because they're different mathematical objects. Jul 9, 2019 at 11:48
• Recommended reading (not 100% duplicates, but close): crypto.stackexchange.com/questions/43894/… and crypto.stackexchange.com/questions/2541/… Jul 9, 2019 at 11:53
• Note that, in the case of RSA, if the public exponent is small (specifically, smaller than the squareroot of one of the prime factors), then the private exponent will always be larger (except for the trivial case of $e=d=1$); for example, for 1024 bit RSA modulus (2 prime), if the public exponent is smaller than 256 bits, this will always be true. Hence, this is not something we need to worry about in practice. Jul 9, 2019 at 12:16

• @NicHartley More precisely, I'm talking about the public exponent (usually written $e$), which is part of the public key. The question uses “public key” in that sense, since it talks about the “public key” and “private key” being mutual inverses. There's a way to look at RSA which makes the two exponents the keys, but it requires defining the modulus $n$ as a parameter which must only ever be used once, which is a complicated way to look at it. A more practical way to describe RSA is that the public key is $(n,e)$ and the private key is $(n,d)$. $e$ is usually 65537 but $n$ is unique. Jul 9, 2019 at 18:55
• @Gilles That's true, but, if you really tried, you could make $e = d$. Jul 12, 2019 at 5:16