Lesson 5.1: Public-key cryptography and SSH keys
Symmetric encryption needs a shared key, and sharing it safely is the hard part. Public-key cryptography solves it with key pairs: a public key anyone may have and a private key that never leaves its owner. How key exchange (Diffie-Hellman) and signatures work in principle, and how SSH uses both: your key pair to log in without a password, and the server's host key to prove you reached the right machine. In the lab you create an Ed25519 key with a passphrase, check its file permissions and fingerprint, then verify two servers' host keys against the fingerprints IT published, and catch one that doesn't match.
18 min
You will learn to
- Explain public and private keys
- Explain key exchange and digital signatures in principle
- Create an SSH key pair with a passphrase
- Read a key's fingerprint
- Verify a server's host key and recognise a mismatch
Key terms
- Public-key (asymmetric) cryptography
- Cryptography with key pairs: what one key does, only the other can undo or check.
- Private key and public key
- The private key stays secret with its owner; the public key can be shared with anyone.
- Key exchange
- A method for two parties to agree on a shared secret over a public channel without sending the secret.
- Digital signature
- A value made with the private key over some data; anyone with the public key can check it, and it fails if the data changed.
- Host key and known_hosts
- An SSH server's own key pair; clients remember its public key in ~/.ssh/known_hosts and warn loudly if it changes.
- Post-quantum cryptography
- New algorithms designed to resist future quantum computers, which could break RSA and elliptic curves.
← Cross-site scripting (XSS) · All lessons · Defence in depth and least privilege →