What is an SSH Key?

An SSH key is a means of authentication used in the Secure Shell (SSH) protocol. SSH itself provides the encrypted connection; the key pair is what proves to the server who is logging in. Unlike a password, a private key is never sent to the server, so it cannot be guessed over the network in the same way, although it can still be stolen or misused if the key file is not protected. An SSH key pair consists of two parts, a private key and a public key, which work together to authenticate a user or machine.

Key Components

• Private Key: This is kept secret by the user and stored securely on the user's computer. The private key is used to create a digital signature that proves you hold it. It should be protected with a passphrase, which adds a layer of security if the key file is copied or stolen.
• Public Key: This can be shared openly and is placed on the servers or systems the user wishes to access (for OpenSSH, in the account's authorized_keys file). The server uses the public key to check signatures made by the matching private key.

How SSH Keys Work

An SSH connection first sets up an encrypted transport and the client checks the server's host key. Public-key authentication then runs inside that encrypted connection. Here's a simplified breakdown of the authentication step, based on the SSH authentication protocol (RFC 4252):

1. Connection: The client connects, and the two sides set up an encrypted transport. The client checks the server's host key.
2. Offer: The client tells the server which public key it wants to authenticate with. The server checks whether that key is authorized for the account.
3. Signature: The client signs authentication data, which includes the session identifier, using its private key, and sends the signature to the server.
4. Verification: The server checks the signature against the authorized public key and grants access if it is valid.

The private key never leaves the client; only the signature is sent. Authentication and encryption are separate jobs: the key pair authenticates the user, while the SSH transport layer encrypts the traffic.

Advantages of Using SSH Keys

• Security: SSH keys remove the password-guessing risk from key-based logins, because there is no password for an attacker to guess. They do not protect against a stolen private key, a compromised client or an unverified server, so passphrases, file permissions and host-key checks still matter.
• Convenience: Once an SSH key pair is set up, users can access systems without frequently entering passwords.
• Automation: SSH keys facilitate automated processes and scripts by allowing secure, passwordless connections between systems. This is particularly useful in DevOps for tasks such as software deployment and system updates.

Best Practices

• Protect Your Private Key: Keep your private key secure and encrypted with a strong passphrase.
• Regular Key Rotation: Replace SSH key pairs on a schedule that suits your risk, and immediately when a key may have been exposed or a person leaves.
• Limit Usage: Use separate SSH key pairs for different systems or environments to minimize the impact in case a key is compromised.
• Monitor and Audit: Regularly audit and monitor the use of SSH keys across your infrastructure to ensure that only authorized keys have access.

SSH keys are a foundational component of secure system administration and network management. They reduce password-based risks, but they are only as safe as the way the private keys are stored, the public keys are authorised and the servers are verified.