SSH key generation (ssh-keygen) in Linux CLI - Deep Dive

Overview - SSH key generation (ssh-keygen)

What is it?

SSH key generation is the process of creating a pair of cryptographic keys used to securely connect to remote computers without passwords. The tool ssh-keygen helps you create these keys, which include a private key you keep secret and a public key you share. This method makes logging into servers safer and easier. It replaces typing passwords with a secure digital handshake.

Why it matters

Without SSH keys, people rely on passwords that can be guessed, stolen, or intercepted, making remote access risky. SSH keys provide a stronger, automated way to prove who you are, protecting your data and systems. This is crucial for developers, system administrators, and anyone managing servers, as it prevents unauthorized access and saves time.

Where it fits

Before learning SSH key generation, you should understand basic command-line usage and what SSH (Secure Shell) is for. After mastering key generation, you can learn how to use these keys to connect to servers, manage multiple keys, and configure SSH agents for convenience.

Mental Model

Core Idea

SSH key generation creates a secret and a public key pair that work together to prove your identity securely without sharing your secret.

Think of it like...

It's like having a locked mailbox (public key) where anyone can drop letters, but only you have the key (private key) to open it and read the mail.

┌───────────────┐      ┌───────────────┐
│  ssh-keygen   │─────▶│ Private Key   │ (Keep secret)
└───────────────┘      └───────────────┘
         │
         ▼
┌───────────────┐
│ Public Key    │ (Share freely)
└───────────────┘

Build-Up - 7 Steps

1

Foundation

What is SSH and Why Keys Matter

Concept: Introduce SSH as a secure way to connect to remote computers and why keys are better than passwords.

SSH (Secure Shell) lets you control another computer safely over the internet. Instead of typing a password every time, SSH keys let you prove who you are using a pair of codes: one you keep secret (private key) and one you share (public key). This makes connections safer and faster.

Result

You understand that SSH keys replace passwords for safer remote access.

Knowing why SSH keys exist helps you appreciate their role in security and convenience.

2

Foundation

Basic ssh-keygen Command Usage

Concept: Learn the simplest way to generate SSH keys using ssh-keygen with default settings.

Run the command: ssh-keygen It asks where to save the key and for a passphrase (extra password). If you press Enter, it uses defaults and no passphrase. This creates two files: id_rsa (private key) and id_rsa.pub (public key) in your ~/.ssh folder.

Result

Two key files are created, ready for use.

Understanding the default behavior of ssh-keygen helps you quickly create keys without confusion.

3

Intermediate

Choosing Key Types and Strength

🤔Before reading on: Do you think RSA or Ed25519 keys are stronger and why?

Concept: Explore different key types like RSA and Ed25519 and how to specify them with ssh-keygen.

You can generate different types of keys: - RSA: Older, widely supported, specify size with -b (e.g., 4096 bits) - Ed25519: Newer, faster, more secure by default Example: ssh-keygen -t ed25519 Choosing the right type affects security and compatibility.

Result

You create keys tailored to your security needs and system compatibility.

Knowing key types lets you balance security and compatibility for your environment.

4

Intermediate

Using Passphrases for Extra Security

🤔Before reading on: Does adding a passphrase make your SSH key less convenient or more secure?

Concept: Learn how passphrases protect your private key and how to add or skip them during generation.

When ssh-keygen asks for a passphrase, you can type one to encrypt your private key. This means even if someone steals your private key file, they can't use it without the passphrase. You can leave it empty for no passphrase, but that is less secure.

Result

Your private key is protected by an additional secret, increasing security.

Understanding passphrases helps you protect your keys from theft while balancing convenience.

5

Intermediate

Managing Multiple SSH Keys

Concept: How to generate and use multiple SSH keys for different servers or purposes.

You can create keys with different names: ssh-keygen -t ed25519 -f ~/.ssh/id_work ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_personal Then configure SSH to use the right key per server in ~/.ssh/config by specifying IdentityFile.

Result

You can securely connect to multiple servers using different keys without confusion.

Knowing how to manage multiple keys prevents security risks and simplifies access.

6

Advanced

Understanding Key Formats and Conversion

🤔Before reading on: Do you think all SSH keys are stored the same way on disk?

Concept: Learn about different key file formats (PEM, OpenSSH) and how to convert between them.

SSH keys can be stored in different formats. Older RSA keys use PEM format, newer OpenSSH keys have a different format. You can convert keys using ssh-keygen -p or ssh-keygen -e/-i to export/import formats. This matters for compatibility with other tools.

Result

You can adapt keys to work with various systems and software.

Understanding formats helps avoid compatibility issues and maintain secure key handling.

7

Expert

Security Risks and Best Practices in Key Generation

🤔Before reading on: Is it safe to share your private key with trusted colleagues for convenience?

Concept: Explore common security mistakes and how to avoid them when generating and using SSH keys.

Never share your private key; it must remain secret. Use strong passphrases and protect your ~/.ssh folder permissions. Regularly rotate keys and remove unused ones. Avoid weak key sizes (e.g., RSA under 2048 bits). Use ssh-agent to manage keys securely in memory.

Result

You maintain strong security hygiene and reduce risk of unauthorized access.

Knowing risks and best practices prevents common breaches and keeps your systems safe.

Under the Hood

ssh-keygen creates a cryptographic key pair using mathematical algorithms. The private key is a secret number, and the public key is derived from it using one-way functions. When you connect via SSH, the server challenges your client to prove it has the private key without sending it. This challenge-response ensures secure authentication without exposing secrets.

Why designed this way?

This design avoids sending passwords over the network, which can be intercepted. Public-key cryptography allows secure identity verification even on insecure networks. ssh-keygen was created to automate key creation with strong defaults, balancing security and usability.

┌───────────────┐
│ ssh-keygen    │
├───────────────┤
│ Generates key │
│ pair:         │
│ ┌───────────┐ │
│ │ Private   │ │
│ │ Key       │ │
│ └───────────┘ │
│ ┌───────────┐ │
│ │ Public    │ │
│ │ Key       │ │
│ └───────────┘ │
└───────┬───────┘
        │
        ▼
┌─────────────────────────────┐
│ SSH Authentication Process   │
│ 1. Client sends public key   │
│ 2. Server sends challenge    │
│ 3. Client signs challenge    │
│    with private key          │
│ 4. Server verifies signature │
└─────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Is it safe to share your private SSH key with a trusted friend? Commit to yes or no.

Common Belief: Sharing your private key with someone you trust is okay because they won't misuse it.

Reality: Your private key must never be shared; it grants full access to your accounts and systems.

Why it matters: Sharing private keys can lead to unauthorized access, data breaches, and loss of control over your servers.

Quick: Does adding a passphrase to your SSH key make it impossible to use automatically? Commit to yes or no.

Common Belief: If you add a passphrase, you can't automate SSH logins without typing it every time.

Reality: Using ssh-agent or keychain tools, you can securely store the passphrase in memory, enabling automation without typing it repeatedly.

Why it matters: Believing this limits security because users avoid passphrases, increasing risk if keys are stolen.

Quick: Are all SSH keys equally secure regardless of type and size? Commit to yes or no.

Common Belief: Any SSH key you generate is equally secure, so key type and size don't matter much.

Reality: Key type and size greatly affect security; for example, Ed25519 keys are more secure and efficient than small RSA keys.

Why it matters: Using weak keys can expose systems to attacks, undermining the purpose of SSH keys.

Quick: Does ssh-keygen overwrite existing keys without warning? Commit to yes or no.

Common Belief: ssh-keygen always warns before overwriting existing keys, so you can't lose keys accidentally.

Reality: ssh-keygen prompts before overwriting, but if you force commands or ignore prompts, you can overwrite and lose keys.

Why it matters: Accidental key loss can lock you out of servers or require complex recovery steps.

Expert Zone

1

Some SSH key algorithms like Ed25519 provide built-in resistance to side-channel attacks, which older RSA keys lack.

2

The private key file permissions must be strictly set (e.g., 600) or SSH will refuse to use the key for security reasons.

3

SSH keys can include certificates signed by a trusted authority to simplify large-scale key management in enterprises.

When NOT to use

Avoid using ssh-keygen for ephemeral or one-time connections where passwordless access is not needed; instead, use temporary tokens or password authentication. For very high-security environments, consider hardware security modules (HSMs) or smart cards instead of plain key files.

Production Patterns

In production, teams use ssh-keygen to create keys per user or service, store public keys on servers, and manage keys with configuration files and agents. They rotate keys regularly, use passphrases with ssh-agent, and audit authorized_keys files to maintain security.

Connections

Public-Key Cryptography

SSH key generation is a practical application of public-key cryptography principles.

Understanding the math behind public-key cryptography deepens comprehension of how SSH keys secure communication.

Passwordless Authentication

SSH keys enable passwordless authentication, improving security and user experience.

Knowing passwordless methods helps in designing secure systems that reduce human error from password use.

Physical Locks and Keys

SSH keys function like physical locks and keys where the public key is the lock and the private key is the key.

This cross-domain connection clarifies why private keys must remain secret and public keys can be shared freely.

Common Pitfalls

#1 Using weak or default key sizes that are vulnerable to attacks.

Wrong approach:

ssh-keygen -t rsa -b 1024

Correct approach:

ssh-keygen -t rsa -b 4096

Root cause:

Misunderstanding that larger key sizes provide stronger security and default sizes may be outdated.

#2 Leaving private key files with open permissions, allowing others to read them.

Wrong approach:

chmod 644 ~/.ssh/id_rsa

Correct approach:

chmod 600 ~/.ssh/id_rsa

Root cause:

Not knowing SSH requires strict permissions to protect private keys.

#3 Not backing up private keys and losing access to servers.

Wrong approach:

Deleting or moving ~/.ssh/id_rsa without backup

Correct approach:

Backing up ~/.ssh/id_rsa securely before changes

Root cause:

Underestimating the importance of private keys and lack of backup planning.

Key Takeaways

SSH key generation creates a secure pair of keys that replace passwords for safer remote access.

Choosing the right key type and size is crucial for balancing security and compatibility.

Protecting your private key with a passphrase and proper file permissions prevents unauthorized use.

Managing multiple keys and using ssh-agent improves convenience without sacrificing security.

Understanding the underlying cryptography and best practices helps avoid common security mistakes.