Private & Public Keys

In public-key cryptosystems, a private key is a key used for digitally signing documents. A public key is a key that can be used for verifying digital signatures generated using a corresponding private key.

In some cryptosystems, public keys can also be used for encrypting messages so that they can only be decrypted using the corresponding private key.

Public keys and private keys come in pairs. The pair is called a key pair. The basic idea of a public key cryptosystem is that the public key can be easily derived from the private key, but the private key cannot be practically derived from the public key. Generally, deriving the private key would be theoretically possible, but the computation would be so complex that it would take millions of years with current computers, or would consume more energy than will be released by our sun during its lifetime.

In SSH, a private key is used for authenticating computers and users. A host key authenticates servers, and an identity key serves as an authentication credential for a user. Together they are called SSH keys.

SSH keys grant access to servers, similar to user names and passwords. Therefore, they should be part of identity and access management in enterprises. All cybersecurity-related laws and regulations also require managing SSH key-based access.

It turns out that in many organizations, SSH keys have not been properly managed, and they have literally millions of keys configured as authorized keys granting access to their servers. An assessment of risk and deployment of SSH key management tools is strongly recommended.

In SSH, public key cryptography is used for authenticating computers and users. Host keys authenticate hosts. Authorized keys and identity keys authenticate users.

The most common type of SSH key is an authorized key, which is a public key.

Over the years, the number of SSH keys in existence has grown steadily. There have not been formal provisioning or termination processes for them. In some customer cases, we have found literally millions of them granting access to the environment. Some of the keys have been more than ten years old. Some have used algorithms or key lengths that have been broken. Most of all, they grant access in ways that violate most cybersecurity laws and regulations.

It is important to manage SSH keys properly. Please see more information on SSH keys and SSH key management.