20

I'm starting to understand how RSA and public/private key systems work, and I was wondering where my private and public SSH key are stored. When I go to my home directory, and I browse my .ssh directory (cd .ssh), I only see the "known_hosts" file, which I guess contains the public keys of different remote SSH servers I know.

Where can I find these keys? I don't even remember creating them by the way, but since I've already established ssh connections before, they must be somewhere.

I'm using OpenSSH_5.2p1 with MAC OS 10.6.

Thanks!

Improve this question

3 Answers 3

Reset to default
16

~/.ssh/id_rsa and ~/id_rsa.pub usually. But it doesn't follow that ssh must create a pair and save them: ssh basically uses the SSL protocol, which establishes a session key using the Diffie/Hellman key-exchange algorithm or some variant. That means the handshake setting up the connection generates a session key and discards it when the session is completed.

Read up on the algorithm, it's pretty nifty: using fairly simple math, it establishes a key known to both ends of the connection without ever sending the key over the connection.

Improve this answer
4
  • Does that mean that if I was never asked to generate SSH keys that RSA has never been used? In other words, that some asymmetric algorithm was used to share the session key, but that the temporary public/private keys for connection weren't stored on my computer?
    – mieli
    Dec 20, 2011 at 23:18
  • That's exactly right. Actually, the encryption is symmetric -- asymmetric algorithms aren't well suited for streaming. The Diffie-Hellman is used to generate a session key for the symmetric encryption. If you instead use a public/private key pair, they're used in some other handshake to create a session key for the symmetric algorithm.
    – Charlie Martin
    Dec 20, 2011 at 23:23
  • @mieli: No. They were never created in the first place. publickey is only one possible authentication method of many; if you simply logged in using password or keyboard-interactive, the password itself was sent. (Note: Do not confuse the user key, the host key, and the session keys.)
    – u1686_grawity
    Dec 20, 2011 at 23:25
  • @grawity we're mostly agreeing here but let's be a little careful. Diffie-Hellman key exchange is related to RSA and other asymmetric encryption algorithms and is essentially asymmetric, since both sides of the exchange have their own "half" of the eventual agreement. They do have two parts of the key, and the eventual key and the exact process to build it are discarded at end of session. They're not, however, the public and private parts of an RSA pair.
    – Charlie Martin
    Dec 22, 2011 at 0:50
4

Your personal public and private ssh keys are normally stored in:

$HOME/.ssh/id_dsa     (private key)
$HOME/.ssh/id_dsa.pub (public key)

Or they could be id_rsa and id_rsa.pub if you created RSA keys rather than DSA keys (OpenSSH supports both forms).

But the fact that you've established ssh connections before doesn't imply that you have ssh keys. If the ssh command can't find your personal key, it will prompt you for a password for the remote system. This is less secure than using keys.

You should normally create your ssh private key with a passphrase. If you create it without a passphrase, someone who gets a copy of your private key can impersonate you. ssh-agent lets you use a key with a passphrase without having to re-enter your passphrase every time you use it.

Improve this answer
3

If you didn't create a keypair, you probably do not have one.

SSH2 traffic is encrypted with a symmetric session key established using DH, ECDH algorithms or GSSAPI key exchange. Neither the host key nor the user key are used for encrypting data – their only purpose is authentication.

Now remember that SSH supports several authentication methods: in addition to publickey, almost all servers accept the simple password and/or keyboard-interactive, in which no key generation or usage takes place – the password is simply sent to the remote server for verification.

In other words, "since I've already established ssh connections before, they must be somewhere" is incorrect – the user keypair is not necessary for establishing connections.

If you did create a keypair, it will likely be in ~/.ssh/id_* – for example, id_rsa for the default RSA keypair, id_ecdsa for ECDSA, id_dsa for DSA. Although these files contain both private and public parts of the keypair, the public part is usually automatically extracted into a separate id_*.pub file for convenience (id_rsa.pub for id_rsa and so on).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .