Say I provide someone with my public SSH key, the id_rsa.pub and he/she installs it on a server that is compromised, and I am asked to login.

Does the login process involve sending my private key to the compromised server?

If yes, then the attacker now has access to my private SSH key, and that is scary.

If no, then why do I see this line in ssh -vvv output:

debug1: Server accepts key: pkalg ssh-rsa blen 277

This implies that the private key was sent to the server, and it accepted it.

Am I misunderstanding the problem?


You are misunderstanding the process.

The key is not sent, rather a "challenge" is constructed by encrypting something with the public key that can only be decrypted with the matching private key.

If you do get asked for your password, or you do X forwarding to a compromised server, then there is a potential security risk.

  • Thanks. ssh emits this message too debug1: Offering RSA public key: <$HOME>/.ssh/id_rsa which makes one think that the private key is being shared even though the id_rsa.pub has already been shared. – Gurjeet Singh Dec 20 '12 at 17:25
  • The public key is, well public. You can give it to anyone. That gives them the ability to encrypt messages. The private key is what lets you decrypt the messages. As long as you keep your private key to yourself, you're okay. – Pete Dec 20 '12 at 19:34

NO, your private key is NEVER "sent" or transmitted anywhere.

Public-key cryptography is not like traditional username/password authentication.

  • Your public key is just that -- public. It is perfectly safe to share it. Sending your public key to someone may give away your identity (people can know that it's from you because it's a unique number), but it can never allow someone else to impersonate you or authenticate as you. You might as well post your public key on SuperUser or on your webpage over regular HTTP; it's perfectly safe, and perfectly useless if someone doesn't have your private key.

  • Your private key is just that -- private. It only resides on systems you own and trust (hopefully), and should always be encrypted with an unlock password for maximum safety, in case someone gains physical access to the system it's stored on. The private key is never transmitted by any properly-implemented security program that is behaving according to the rules of public-key cryptography. That is, unless you have a program on your local system that is compromised and is capable of reading your private key (and the private key is not encrypted by a password), your private key is safe, always.

Messages are signed with the private key, on your computer, before they're sent to the remote server. So, rather than sending the private key to the remote server, you are sending a message that was encrypted with the private key. But these two things are not the same: you can't derive the private key from the signed message; that's part of the point of public key cryptography.

In short, even if a hostile attacker obtains your public key and obtains messages signed by your private key, they still will be unable to obtain your actual private key, and thus, they cannot impersonate your credentials or use your private key to authenticate "as you".

  • I understand the public-key crypo process, but was confused by the debug message emitted by ssh. Answer from @pjc50 seems to provide the assurance I was looking for. – Gurjeet Singh Dec 20 '12 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.