Week 1, Day 3 — SSH Keys

Asymmetric cryptography, the SSH key auth handshake, and why keys beat passwords

Part 1 — Symmetric vs. asymmetric encryption (8 min)

• Symmetric encryption: One key encrypts and decrypts. Both parties must have the same key. The problem: how do you securely share the key in the first place? If you could securely send the key, you probably didn't need encryption to start with. Good for bulk data (AES), but has a key distribution problem.
• Asymmetric encryption: Two mathematically linked keys — a public key and a private key. Anything encrypted with the public key can only be decrypted with the private key. Anything signed with the private key can be verified with the public key. The public key can be shared openly — there's no risk in publishing it. The private key never leaves the machine that owns it.
• Analogy: a padlock and its key. You hand out padlocks (public keys) to anyone who wants to send you a locked box. Only you have the key (private key) that opens them. Anyone can lock a box for you — only you can open it.
• RSA: one of the oldest and most widely-used asymmetric algorithms. Key strength is measured in bits — the larger the key, the more computationally expensive to break. 2048-bit was once the standard; 4096-bit is the current recommendation for long-lived keys. The computational cost to generate or use a 4096-bit key is trivial on modern hardware.

Part 2 — The SSH key authentication handshake (12 min)

• Walk through what happens when you SSH with a key — draw this on the board step by step:
  1. Client connects to server, announces its public key identity
  2. Server checks ~/.ssh/authorized_keys — is this public key listed?
  3. If yes: server generates a random challenge and encrypts it with the client's public key
  4. Client decrypts the challenge using its private key, sends back proof
  5. Server verifies the proof — only the holder of the matching private key could have produced it
  6. Connection established — no password ever sent over the wire
• Ask: "Why is this stronger than a password?" Build the list together:
  · The private key never travels over the network — there's nothing to intercept
  · Even if someone captures every byte of the SSH session, they can't extract the key
  · A 4096-bit private key is effectively impossible to brute force — a good password might be 12 characters; that's far weaker
  · No server-side password storage — there's no hashed password database to steal
• The two files: id_rsa — the private key. Never copy this to any server. Never email it. Never share it. Treat it like a physical key to your building. id_rsa.pub — the public key. This is what you copy to servers. Safe to send by email, post on a website, or put on a USB drive. It's useless without the private key.
• File locations: On Windows, ssh-keygen stores keys in C:\Users\[username]\.ssh\. On Linux servers, each user's authorised public keys are in ~/.ssh/authorized_keys. The .ssh directory must be mode 700, and authorized_keys must be mode 600 — SSH is strict about this and will silently ignore keys with wrong permissions.

Part 3 — Key passphrases and agent forwarding (10 min)

• Passphrases: When generating a key, ssh-keygen offers to encrypt the private key file with a passphrase. This adds a second factor — even if someone steals the key file, they can't use it without the passphrase. For this course we skip the passphrase (simpler for lab work), but in production, a passphrase is strongly recommended.
• SSH agent: If you use a passphrase, you'd have to type it every time you connect — annoying. The SSH agent is a background process that holds your decrypted private key in memory for the session. ssh-add loads the key into the agent; after that, connections use the agent without prompting again. Windows OpenSSH includes an agent service.
• Why we use 4096 bits specifically: 2048-bit RSA keys are still considered secure today, but key generation is cheap and storage is trivial. There is no practical reason not to use 4096 bits. Some organisations mandate 4096-bit as policy. The habit of using the stronger key is worth building.