11

Is it a security risk to allow anyone to see your SSH public key?

My public key(s) are on all the machines I login to regularly, and I've also given other sysadmins my .pub file so they allow me access to their servers, as required.

But: how safe is it to publish my public SSH keys for the entire world to see? There are plenty listed in various github repos, dotfiles and the like, and I'm also considering doing the same. I'm a sysadmin, and paranoid (but I repeat myself...) and so would appreciate some clarification.

|improve this question
  • 2
    I'm afraid, you selected wrong place to ask. IT Security or CS or Math sites seems as more appropriate places. And accepted by you answer is wrong, plain crystal-clearly wrong in all three statements – Lazy Badger Mar 24 '12 at 15:16
  • 4
    @LazyBadger is not too lazy to complain about the given answer, but too lazy to provide the correct answer – 75th Trombone May 12 '15 at 16:34
15

Making your public key really public will of course make your key pair less secure than if the public key was also secret. Nobody can pick a lock if they have never seen the lock.

But even if someone has your public key, there still is no known, viable option of finding your private key based on it.

Of course, if someone tomorrow finds a way to calculate the private key based on your public key, then it would have been safer to have never given the public key out. But that simply isn't going to happen. And if it does, nobody is going to care about your public key, believe me :P

|improve this answer
  • 2
    Well said, however, not quite true. There are ways of calculating the private key given the public key. This doesn't on the other hand make giving out your public key 'unsafe', since it would in most cases take decades or even hundreds/thousands of years to calculate the two primes, which are needed to decrypt the message. – 0sh Mar 24 '12 at 12:18
  • 6
    @Milosz: Saying there are ways of calculating the private key is just misinformation. Might as well say "You might get hit by a rainbow colored van tomorrow, then hit by a blue truck all the while drinking milk in your house!! It really is possible" -_- but unlikely* – surfasb Mar 24 '12 at 12:35
  • 4
    Well, the alternative is saying there is no way of calculating the private key from a public key, which is simply false. – Marcks Thomas Mar 24 '12 at 14:10

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.