Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So, I have no experience here, but what sorts of problems can be caused by a compromised private RSA key? Is this even that big of a deal? I'm getting very little specific info on Google. :(

share|improve this question
5  
It ENTIRELY depends on what the RSA is being used to protect! –  Celada Jan 25 '13 at 21:53
2  
Do not use compromised private key for anything. Create a new pair. –  Kride Jan 25 '13 at 21:55
    
Based on webmasters.stackexchange.com/questions/42680/… (which this is a duplicate of) I am assuming that this RSA is used in some sort of web context, but you need to be a lot more specific. –  Celada Jan 25 '13 at 21:56
    
Yeah, I posted it there before I realized there was a better community for this sort of question. I'll delete it there... –  Nooblet Jan 25 '13 at 21:58
add comment

1 Answer

up vote 2 down vote accepted

It depends on what the private key was used for.

  • If it was a SSH key used to log into remote servers, then anyone who has the key could log into the owner's account on those servers – exactly as if their password was compromised.

  • If it was a SSH "host key", or if it belonged to an X.509 certificate used for SSL, then anyone who has the key could pretend to be that server whose key was stolen – see man-in-the-middle attack for description.

  • If it was a PGP key or an X.509 certificate used for S/MIME, then it could be used to decrypt mail received by the key's owner, or to sign forged messages that pretend to be from the key's owner. PGP keys, as well as "code-signing" X.509 certificates, are also frequently used to sign computer programs, so those would be possible to falsify as well.

  • If the key belonged to an X.509 "certificate authority" certificate, then somebody could use it to create new certificates for any name – for example, they could create a SSL certificate for *.google.com and use it in a MitM attack (see above).

  • etc.

I should also mention that RSA is only one of several key types, just the most common one; DSA or ECDSA keys are also used for the same purposes. See public-key cryptography for a general overview.

share|improve this answer
    
I realize this was a stupid question (hence the flurry of down-voting) but I really appreciate you taking the time to answer. Thanks. –  Nooblet Jan 25 '13 at 21:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.