Understanding SSH Key-Based Authentication
Secure Shell (SSH) protocol (RFC 4253) uses asymmetric public-key cryptography to authenticate users to remote servers without transmitting reusable passwords over the network. An SSH identity consists of a key pair:
- Public Key (e.g.
id_ed25519.pub): Installed on remote Linux servers in~/.ssh/authorized_keys. It encrypts verification challenges that only the matching private key can solve. - Private Key (e.g.
id_ed25519): Kept securely on the local client machine, protected by a passphrase. Never share or upload private keys.
SSH Key Algorithm Comparison: Ed25519 vs RSA 4096 vs ECDSA
| Algorithm | Key Size | Security & Performance Rating | Modern Recommendation |
|---|---|---|---|
| Ed25519 | 256 bits | Exceptional. Immune to timing side-channels, short key string. | Recommended for all new servers. |
| RSA 4096 | 4096 bits | Very High. Universal legacy compatibility. | Good for older legacy hardware that lacks Ed25519. |
| ECDSA | 256/384/521 bits | High, but vulnerable if random number generator is flawed. | Use Ed25519 instead. |
| DSA / RSA 1024 | < 2048 bits | Broken / Insecure. Deprecated in OpenSSH 7.0+. | Do NOT use. |
How to Generate and Deploy an Ed25519 SSH Key
# 1. Generate a modern Ed25519 key on your laptop:
ssh-keygen -t ed25519 -C "[email protected]"
# 2. Copy the public key to your Linux server:
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]
# 3. Connect securely without password:
Frequently Asked Questions (FAQ)
What does 'Host key verification failed' mean?
When you connect to an SSH server, your client records the server's public key fingerprint in ~/.ssh/known_hosts. If the fingerprint changes later, SSH stops the connection to protect you from potential DNS hijacking or Man-in-the-Middle attacks. If the server was legitimately reinstalled, remove the old key with ssh-keygen -R server_ip.
What permissions must ~/.ssh and authorized_keys have?
OpenSSH strictly refuses authentication if directory or file permissions are too open. Ensure chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys on your Linux server.