Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So, I have no experience here, but what sorts of problems can be caused by a compromised private RSA key? Is this even that big of a deal? I'm getting very little specific info on Google. :(

share|improve this question
It ENTIRELY depends on what the RSA is being used to protect! – Celada Jan 25 '13 at 21:53
Do not use compromised private key for anything. Create a new pair. – Kride Jan 25 '13 at 21:55
Based on… (which this is a duplicate of) I am assuming that this RSA is used in some sort of web context, but you need to be a lot more specific. – Celada Jan 25 '13 at 21:56
Yeah, I posted it there before I realized there was a better community for this sort of question. I'll delete it there... – Nooblet Jan 25 '13 at 21:58
up vote 2 down vote accepted

It depends on what the private key was used for.

  • If it was a SSH key used to log into remote servers, then anyone who has the key could log into the owner's account on those servers – exactly as if their password was compromised.

  • If it was a SSH "host key", or if it belonged to an X.509 certificate used for SSL, then anyone who has the key could pretend to be that server whose key was stolen – see man-in-the-middle attack for description.

  • If it was a PGP key or an X.509 certificate used for S/MIME, then it could be used to decrypt mail received by the key's owner, or to sign forged messages that pretend to be from the key's owner. PGP keys, as well as "code-signing" X.509 certificates, are also frequently used to sign computer programs, so those would be possible to falsify as well.

  • If the key belonged to an X.509 "certificate authority" certificate, then somebody could use it to create new certificates for any name – for example, they could create a SSL certificate for * and use it in a MitM attack (see above).

  • etc.

I should also mention that RSA is only one of several key types, just the most common one; DSA or ECDSA keys are also used for the same purposes. See public-key cryptography for a general overview.

share|improve this answer
I realize this was a stupid question (hence the flurry of down-voting) but I really appreciate you taking the time to answer. Thanks. – Nooblet Jan 25 '13 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .