Public Key Authentication

· Updated · 2 min read · Security · Concept

A public key is a cryptographic key that is part of a key pair used for public key cryptography. In the context of SSH (Secure Shell) and other cryptographic systems, a public key is associated with an entity (like a user or a server) and is shared openly.

Public keys characteristics #

Key Pair #

Public key cryptography uses pairs of keys – a public key and a private key. These keys are mathematically related: what one key encrypts can only be decrypted by the other key.

Sharing the Public Key #

The public key can be freely distributed and shared with others. It is typically used for encryption or verification of a signature.

Asymmetric Encryption #

Public key cryptography is asymmetric, meaning the public key is used for encryption, and the private key is used for decryption.

Authentication #

In systems like SSH, the public key is used for user authentication. The server stores the user’s public key and uses it to verify that the user owns the matching private key, which never leaves the user’s computer.

Digital Signatures #

Public keys are also used to create digital signatures, providing a way to verify the authenticity of a message or file.

Format #

Public keys are usually in a specific format, such as the OpenSSH format which starts with “ssh-rsa” (for RSA keys) or “ssh-ed25519” (for Ed25519 keys).

When someone wants to send you an encrypted message or verify your identity (e.g., for SSH access), they use your public key. The corresponding private key, which is kept secret, is used for decryption or creating digital signatures.

Key Pair Generation #

Key Pairs are generated using the command line tool ssh-keygen. This command is typically available on Unix-like operating systems, including Linux and macOS.

See Generating and using AWS Key Pairs with Terraform or OpenTofu.

You generate a pair of keys – a public key and a private key. The public key is placed on the server, while the private key is kept secret on your local machine.

Server Configuration #

On the server, a file named authorized_keys (commonly found in the ~/.ssh/ directory) holds the public keys of users allowed to log in. In cloud instances the Public key is usually added during instance creation using Cloud-Init.

Authentication Process #

When a user attempts to log in, the server sends a challenge. The user’s local machine uses the private key to sign the challenge and sends the signature back to the server. The server checks the signature with the stored public key. If it is valid, access is granted.

See tutorials using Public Key Authentication:

#AWS EC2 #Public-Key #SSH