Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I generated a pair of keys i.e. private and public keys using Putty's key generation tool. The public key was provided to the third party we plan on connecting to so that we only need our private key as a form of authentication when connecting. However when I connect to the server, the finger print I get is different to what was generated in Putty. Is this normal? Should I expect the fingerprints to match? Why would it not match?

share|improve this question
up vote 1 down vote accepted

Yes, it is normal.

In SSH, servers usually have their own keys, often called "host keys", used by PuTTY to make sure it is connecting to the right server; a SSH client will verify the server's key as the first thing done after connection. When PuTTY displays the key confirmation screen, it will show fingerprints of the server key, and your user key is not used for anything yet.

share|improve this answer
How do I verify that the server's key is legitimate? Why would the server's key be used if we have provided the public key? – PeanutsMonkey Jul 3 '12 at 19:28
Remember that everyone has their own public/private key pair. The key you gave the server is your public key, to prove your identity. The server is offering you its public key during connection negotiation to encrypt the connection for secure shell. Two different purposes, two different key pairs. – lonstar Jul 3 '12 at 19:29
@PeanutsMonkey: Owners of (semi)public servers usually publish the fingerprints on their website. For private servers, you can ask the owner or admins. – grawity Jul 3 '12 at 19:29
Agree with @grawity - if you have concerns contact the server operator and ask for their public key fingerprint (don't send them what you received, check what they send you against what you're seeing). – lonstar Jul 3 '12 at 19:32
@PeanutsMonkey: Remember that your public key is, well, public. It can be used to check your identity because you hold the private half of the key, but it cannot be used to verify the server's identity because many servers could have the public half. This is why a server key is needed – it lets PuTTY ensure it is connecting to the right server, because only that server's key will have the right fingerprint. – grawity Jul 3 '12 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .