SSH Key Generation: A Secure Access Guide

SSH (Secure Shell) keys stand out in secure communications as a fundamental element, offering a robust method to authenticate users, while the SSH protocol itself encrypts the connection over insecure networks. Understanding how to generate and manage SSH keys is crucial for anyone looking to secure their digital infrastructure. This blog post dives deep into the art and science of SSH key generation, covering essential concepts, step-by-step instructions, and best practices.

Understanding SSH Keys

SSH keys come in pairs: a private key that remains securely with the user and a public key that can be shared with servers or services. Unlike password-based authentication, SSH keys remove the need to type or send a password, which reduces your exposure to password guessing and brute-force attacks. Keys do not stand alone, though. A private key still needs a passphrase and tight file permissions, you should verify the server's host key the first time you connect, and you need a way to revoke keys you no longer trust. Protection against eavesdropping comes from the SSH transport encryption, not from owning an authentication key.

Choosing the Right Algorithm and Key Size

Before generating an SSH key, selecting an appropriate cryptographic algorithm and key size is vital. Common algorithms include:

• RSA (Rivest-Shamir-Adleman): Widely supported. The OpenSSH ssh-keygen manual gives a minimum of 1024 bits and a default of 3072 bits, and treats 3072 as sufficient; larger sizes such as 4096 bits are slower but still valid.
• ECDSA (Elliptic Curve Digital Signature Algorithm): Offers equivalent security to RSA with shorter key lengths, making it faster. Commonly used curves are nistp256, nistp384, and nistp521.
• EdDSA (Edwards-curve Digital Signature Algorithm): Known for its high performance and security, ed25519 is a popular choice. It has a fixed key length, so no size option is needed, and it is the default key type in current ssh-keygen manual pages.

Generating SSH Keys

Linux and macOS

1. Open a Terminal: Access your command line interface.
2. Generate the Key: The ssh-keygen command specifies the algorithm and, for RSA, the key size. For example, to generate an Ed25519 key, use:

   ssh-keygen -t ed25519

   If a server or service requires RSA, you can generate a 4096-bit RSA key instead:

   ssh-keygen -t rsa -b 4096

3. Save the Key: When prompted, choose a secure location and name for your key pair.
4. Set a Passphrase: Adding a passphrase adds an extra layer of security, protecting your private key if it falls into the wrong hands.

Windows (Using PuTTYgen)

1. Download and Open PuTTYgen: Start the program and select the desired key type and size.
2. Generate the Key: Click on the "Generate" button and follow the instructions.
3. Save the Private Key: Set a passphrase, then use the "Save private key" button and choose a secure location. PuTTYgen saves it in PuTTY's own .ppk format.
4. Copy the Public Key: To authorise the key on an OpenSSH server, copy the text from the "Public key for pasting into OpenSSH authorized_keys file" box rather than the file from "Save public key", which uses a different format.

Distributing Your Public Key

Once generated, you must distribute your public key to servers or services you require access to. This usually involves appending the public key (the .pub file, never the private key) to the ~/.ssh/authorized_keys file of the account on the target server. OpenSSH's sshd will refuse to use that file if the file, the ~/.ssh directory or the home directory can be written by other users (unless StrictModes is turned off, which we do not recommend), so keep those permissions tight. Also confirm the server's host-key fingerprint on first connection, and remove a public key from authorized_keys when it should no longer have access.

Best Practices

• Keep Your Private Key Secure: Never share your private key. Protect it with a strong passphrase and store it in a secure location.
• Rotate and Revoke Keys: Replace keys on a schedule that fits your risk, and remove a key's public half from every authorized_keys file as soon as the key is lost, exposed or no longer needed.
• Use Strong Passphrases: Enhance the security of your private key with a robust passphrase.

Conclusion

Mastering SSH key generation is a critical step toward securing your digital environment. By choosing the right algorithm, protecting your private key, and following best practices, you can ensure secure and efficient access to remote servers and services.