What's the benefit of using asymmetric keys over passwords?

Question

Is there a benefit to using keys over regular passwords when it comes to logging into a remote server over SSH? (Besides not having to remember/input that password)

Answer 1

Is there a benefit to using keys over regular passwords when it comes to logging into a remote server over SSH? (Besides not having to remember/input that password)

Two simple benefits are:

• Keys are much less guessable. They are generated randomly, so an attacker has to have some access to the key material. This is not true when your password is 'secret'.
• The access granted to the possessor of the key is configurable in the authorized_keys file per man sshd

Note, however, that having the keys unprotected on disk is LESS secure than having a secure password in your brain. Access to the disk can be gained without your knowledge. I doubt the same is true for your brain. A good approach is a combination of the two: Protect your private key with a secure password.

Answer 2

If you put a password on that assymetric key, you can keep using the same password well beyond what your sysadmin has configured for password rotation AND leverage the benefits of two factor security. Lose that laptop with the key on it? You are not nearly as screwed!

Answer 3

Yes. If the keypair is compromised -- for example if you lose your laptop with a private key -- you can disable that key on the server and be secure once more.

If you had stored the password on that laptop, you would need to change the password in order to regain a secure system. Now you would also have to change the stored passwords on all you client machines. Much more work :)

Answer 4

No, there's not really an advantage.

Asymmetric cryptography makes sense as a solution to the key exchange problem. But, in order for that to work, it requires a third-party "authority", and a PKI. These typically aren't part of an SSH deployment, so it doesn't really help.

One exception would be if you store your private key on a smart card, and your SSH client is smart-card–enabled. The security of the key in a set up like this is a huge advantage over a password.