SSH-Keygen Essentials: How to Generate and Manage SSH Keys

The SSH protocol provides advanced communications protection to guard against security vulnerabilities including ransomware and other attacks.

For system administrators and users, it all begins with the ssh-keygen tool, which acts as the important enabler of SSH key creation and management.

The Purpose of SSH Keys

SSH keys (short for ‘Secure Shell keys’) can provide a supplement or alternative to traditional username-and-password access methods. The password methods can become particularly pervious to phishing and brute-force cyber-attacks.

For its part, the SSH protocol works by coupling a public key residing on a server with a corresponding private key located on a client machine. That allows systems to communicate encrypted information across unsecured networks.

Taken together, these keys constitute a key pair that stands as a secure access credential for authentication. That is useful for data center servers, as well as remote networked servers and clients. The ssh-keygen tool for key generation thus become an important tool in administrator and user toolboxes.

How Does the SSH Protocol Work?

The SSH protocol uses the application layer above the transport layer in the TCP/IP stack. SSH key pairs employ public key infrastructure (PKI) to provide encrypted operations.

Related:Incident Response: Lessons Learned from a Data Center Fire

Here, the basic handshake is described:

The ssh-keygen utility is supported at the command-line level by Unix, Linux, MacOS, Windows and other operating systems for generating secure keys. It is also used to manage and convert authentication keys.

Related:A Guide to Cloud Resilience: Maximize Security, Minimize Downtime

Among public key cryptographic algorithms that can be used with ssh-keygen tools are DSA, ECDSA, ECDSA-SK, ED25519, and RSA. 

How to Choose Strong Algorithms and Key Sizes

The choice of algorithm and key length is an important step in key creation, and implementors must balance factors such as latency, computational overhead required, and level of security in selecting a key’s big length, which can typically range from 256 bits to 4096 bits depending on the algorithm version. In fact, bit-counts can range much higher.

Still, some modern cryptographic algorithms can achieve excellent security with relatively modest bit complements.

SSH-Keygen Commands

SSH is a protocol, not a software program, but ssh-keygen commands are naturally essential to operations. Among important commands are the following:

ssh-keygen -t

This command generates new pairs using the RSA PKI algorithm.

ssh-copy -id

This command works to install a key.

-e flag

This command asserts that the user wants to use a private key file for authentication. Options to this operation include

-f input_keyfile / -m key_format

These commands both specify the private key file format.

SSH Keygen General Commands

The infographic below outlines some common ssh-keygen commands:

SSH Keygen Features and Enhancements

The ssh-keygen protocol receives enhancements over time. These include new cryptographic algorithms, features, and bug fixes. Useful updates have been a marked characteristic since the advent of SSH-1. That original effort saw continually greater use.

A Brief of History of SSH

SSH-1 first gained use as an alternative to a Telnet (Teletype Network) protocol originally used for handling internet communications. The roots of SSH trace to 1995, when a password-sniffing attack caused Finnish researcher Tatu Ylönen to devise the protocol using RC4 encryption.

At the time, network sniffers had begun to find use observing and capturing packetized information. These hardware-based sniffers were joined with software-based sniffers over time. The original SSH encryption cypher has been subsequently updated.

As with any other technology choice, the SSH key is not a Silver Bullet. The SSH key and associated processes require careful design and management to protect communications. Still, the SSH protocol has proved to be more than a somewhat useful replacement for Telnet.

Addressing Admin Concerns

The ssh-keygen provides data center staff with an alternative to traditional usernames and passwords for accessing remote servers. However, the ssh-keygen command’s wide use must be tempered with the understanding that SSH keys can proliferate wildly in an organization – thus, requiring consistent attention to key management.

For optimal management, ssh-keygen admins and users should pay attention to key rotation, secure private key storage, and general compliance practices relevant to their use cases.

The ability for administrators to independently assign encrypted communications garners great benefit in organizations that need to move quickly while still ensuring network security.