I have a password on my private key. When I login via Putty I need to input my password. Curious if this password is used locally or requested of by the server? Could this be a security risk because the password isn't encrypted?

Authenticating with public key "private-rsa"
Passphrase for key "privatekey-rsa":

Its used locally and is never transmitted to the server. You can verify this by removing (or maybe changing) the passphrase - and you will see nothing on the server changes.

The passphrase simply encrypts the private key. The private key is never transmitted to the server - indeed ideally it should never be transmitted. (only public keys which are derived from it)

Its not a security risk. The passphrase is used as a second factor to ensure your private key remains private, even if someone manages to get a copy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.