For convenience I had an id_rsa keypair and duplicated them with a new name. I may or may not use them consistently on different machines. (The reason was to keep an existing id_rsa on a machine I didn't own.) Today I decided to give them new passwords ssh-keygen -f id_rsa -p. Just to make sure, I checked md5 on both sets to see that they were identical before and after. After I changed the passwords on the private keys, they were different but the public keys remained the same. Which is what I wanted.

How worried should I be that there are now two individual solutions to the public keys? In theory I could keep doing this couldn't I? So clearly there are multiple solutions. How many?

  • 1
    $\begingroup$ There aren't "two solutions", the key pairs are identical. The only difference is that one of the private key files is passphrase protected while the other isn't. As for the security of using the same key pair for multiple purposes, this is better suited for security.stackexchange.com $\endgroup$
    – Marc
    May 25 '20 at 4:58
  • 1
    $\begingroup$ Also note that the encryption is probably randomized, so setting a new password on both of them (even if it's the same) will yield different ciphertexts with high probability. $\endgroup$
    – SEJPM
    May 25 '20 at 8:26
  • $\begingroup$ The question as it stands is suitable here. However, I think that the current question is based on a misconception, as pointed out by Marc. @Marc I think your comment is actually the answer. $\endgroup$
    – Maarten Bodewes
    May 25 '20 at 23:35
  • $\begingroup$ I actually changed the password on both private keys to the same phrase. I think SEJPM is correct. I imagine a different salt might account for the difference? $\endgroup$
    – dcvii
    May 26 '20 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.