This is an old revision of the document!
Understanding SSH Key Pairs
In every SSH/SFTP connection, there are four keys (or two key pairs) involved. This article explains the difference between them and what keys an SFTP client user needs to care about.
The SSH employs public key cryptography. A public-key cryptography, also known as asymmetric cryptography, is a class of cryptographic algorithms which requires two separate keys, one of which is secret (or private) and one of which is public.1 Together they are known as a key pair. In SSH, the public key cryptography is used in both directions (client to server and server to client), so two key pairs are used. One key pair is known as a host (server) key, and the other is a user (client) key.
Advertisement
-----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAi+D6tOmB0uDx4n9ldVKrCvRHyOKSS0Su2D3hUfFfzCF9j7el cYV3tKeedy7CWny12JFUSgzCtgkTNDXWPLR5RK9iS1oWPiAfZn+epQ1hxG2VuuIS ejXvOjCrwz1EYn5djW/XSHuQ03pahUFedP7Bp9sh99zjrF5VQFAhVzXLuKaFEyEK anx+cP+S+ltUo25HUUVIxW58hFsuOydsZwFs5Y4RoayUu1oCovB8uWtQkd59m2dV Vzwya2Tg99R28iabZ+XMXtG0ZNNTGCLzlIKbFsiz7ive8hWtwssKafFBb567JhWX AyFk1mzqE/acafPBr56hE+JLqBBAZQr3G4B87QIDAQABAoIBAEHHS751rLJhS/5q UGjqtjqRg4xpV8iDhQF1oBbrvlP9T9Gc1/VZgWB4DqIXYBgzW0R7mzqzY4E9JUXB J30mlXyCSWQL+je+3WVTEGSntVks+2OF2pCT+mrP5oYKsrTqnc3cUU3ppcJ9YEIX 6nZ0MtdfykqIGpy9Q7PZusQLLUEogmRR/Vcv5McvGsd2HTvXjLyeueGR/29KUwlw FDTw7tavDe77rXbhbi+83Cv8QLizG3i9xPgN9arbbyvY7hKURFpcPiItNmIVuQBI 80I1NZxwxhl89FbFABGNYwAuB9uB4nfvKl5Pm/CiCHOvgx0qwIa/1oLxpulfygNh 5bos2OECgYEA1QFttO2ddasOPSoePf1WBMU8F86cmFh1fwznDBTXYDNXGW7mZNYT OZYDmgt33Rmp51babM9WDckcncyu/hFnVvUFCcARoOXkyDq/qdppE5LjZev/G3+x EjZE/I26l8KKyNG01bmWvh7Sespx1LfQxoLREN/fEVoe34utWj1ZbiUCgYEAqBzl BLA4cCfz7VqLNthtEK5ptZnUM1KENDy4dXpEZlxCYKtwRMHO8AxksRlRbxemvh+5 tUGCf/dS8+NrGTT9T0Z5dKjXA6T5mQcFT7Kz92yVlQcGg19PXFs2TFiFYCATfWyt fRHfBvi+WgIS/5fn10lXYBXGfclqBQbi6mRwpSkCgYEAqfUN2EOQVAc8wUkOAGBX dk759/T/tf8/ITTmVhl7EGNmqAB5DRRTGqu8C/oClgSYMOJ4PkHhY/aIQtDDAC5a ymOOtYzvg/ZraeiWbay8EsYtc3Guh/6HBwUOXoWn0NeFbV8Gb1I6GVD2mMtXsGdK ylou/svibTH/WFdW5p308ZECgYEAoRzP/2ZDMHmZtGeJ884G+G2usXPzghwax1VK EoxS8SaKFss2lS6IfFXkSjXRbX5lNuCAwc0+nBUTUtko0seN3GPWEo+dQMjizF2G IZNKFl3iHSjWfSDilch0iUZszGrxQsrcmXh/HddV1j0WqA2VCyYmrtcvm21kRd0L q0cHDcECgYBJ3UvaBq4ZVWDxEn0tpjp7DrIhdEjA6O8SwQVprgPKQZo2S4oHJAPI j/I+Bq6c0VfZjCVVvNCjzbTrvYjldHCaE4T4nSeRq433JKxe/v45krinAt64NTQN JXK7q98+/SDOn4KFfINbj0emo0Fzw4BnMXeg7Tl/PshpeKJsrng8aQ== -----END RSA PRIVATE KEY-----
User Public Key
A user public key is a counterpart to user private key. They are generated at the same time. The user public key can be safely revealed to anyone, without compromising user identity.
Advertisement
To allow user authorization on a server, the user’s public key is registered on the server. In the most widespread SSH server implementation, the OpenSSH, file ~/.ssh/authorized_keys is used for that.
Learn more about public key authentication in general and how to setup authentication with public keys.
Host Private Key
A host private key is generated when the SSH server is set up. It is safely stored in a location that should be accessible by a server administrator only. The user connecting to the SSH server does not need to care about host private key in general.
Host Public Key
A host public key is a counterpart to host private key. They are generated at the same time. The host public key can be safely revealed to anyone, without compromising the host’s identity.
To allow authorizing the host to the user, the user should be provided with host public key in advance, before connecting. The client application typically prompts the user with host public key on the first connection to allow the user to verify/authorize the key. The host public key is then saved and verified automatically on further connections. The client application warns the user if the host key changes.
- The text is partially copied from Wikipedia article on Public-key cryptography. The text is licensed under GNU Free Documentation License.Back