13

Is it a security risk to allow anyone to see your SSH public key?

My public key(s) are on all the machines I login to regularly, and I've also given other sysadmins my .pub file so they allow me access to their servers, as required.

But: how safe is it to publish my public SSH keys for the entire world to see? There are plenty listed in various github repos, dotfiles and the like, and I'm also considering doing the same. I'm a sysadmin, and paranoid (but I repeat myself...) and so would appreciate some clarification.

Improve this question
2
  • 2
    I'm afraid, you selected wrong place to ask. IT Security or CS or Math sites seems as more appropriate places. And accepted by you answer is wrong, plain crystal-clearly wrong in all three statements
    – Lazy Badger
    Mar 24, 2012 at 15:16
  • 4
    @LazyBadger is not too lazy to complain about the given answer, but too lazy to provide the correct answer
    – 75th Trombone
    May 12, 2015 at 16:34

1 Answer 1

Reset to default
17

Making your public key really public will of course make your key pair less secure than if the public key was also secret. Nobody can pick a lock if they have never seen the lock.

But even if someone has your public key, there still is no known, viable option of finding your private key based on it.

Of course, if someone tomorrow finds a way to calculate the private key based on your public key, then it would have been safer to have never given the public key out. But that simply isn't going to happen. And if it does, nobody is going to care about your public key, believe me :P

Improve this answer
4
  • 2
    Well said, however, not quite true. There are ways of calculating the private key given the public key. This doesn't on the other hand make giving out your public key 'unsafe', since it would in most cases take decades or even hundreds/thousands of years to calculate the two primes, which are needed to decrypt the message.
    – Milo Wielondek
    Mar 24, 2012 at 12:18
  • 8
    @Milosz: Saying there are ways of calculating the private key is just misinformation. Might as well say "You might get hit by a rainbow colored van tomorrow, then hit by a blue truck all the while drinking milk in your house!! It really is possible" -_- but unlikely*
    – surfasb
    Mar 24, 2012 at 12:35
  • 4
    Well, the alternative is saying there is no way of calculating the private key from a public key, which is simply false.
    – Marcks Thomas
    Mar 24, 2012 at 14:10
  • Also see SSH Key Management Overview & 6 Best Practices.
    – Martin Zeitler
    Jan 17, 2020 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.