Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Saw a question on Twitter about moving the current SSH Keys to the same machine after a new installation.

This raised my curiosity and I asked myself how they are made. I understand the process on generating a key and the difference between the private and public.

Logically I assume that the keys are generated at random and have nothing to do with the hardware/os (besides the last line with the user/computer) they are on.

Thanks for any insight. I always enjoy learning how things "tick".

share|improve this question
add comment

6 Answers

up vote 2 down vote accepted

SSH uses pre-generated public and private keys. Once generated these keys are stored for future use. The content of the keys should not be related to the hardware or O/S, but do depend on the random numbers they provide.

There are various formats used to transport the keys. If you move from one platform to another you may need to change the key format. Putty uses a different format than OpenSSH, but there are tools for both to convert the format.

The private key should rarely need to be transported. If they are they must be kept secure. Public keys and are freely distributable, and are automatically exchanged during the connection. Usually known keys are stored so that the verification dialog is not required on subsequent connections.

I generally generate new keys for new devices as this is more secure. It does require re-establishing trust relationships. Copying the old keys may allow the transfer of trust. Sometimes the trust includes other information such as hostname and/or IP address preventing the transfer of trust.

An existing known host list can be transferred. This allows you to transfer the list of devices you trust. This does not guarantee they will trust you.

share|improve this answer
add comment

Make sure you know exactly what you're getting into -- there's a lot of math. Asymmetric key cryptography works by generating a modulus from the product of two very large prime numbers, which are chosen at random using a cryptographically secure pseudo-random number generator. Using this modulus and modular arithmetic, two keys are generated such that the public key can be derived from the private key, but not vice versa.

The first Wikipedia link is a general introduction to public-key cryptography. The second is a specific description of how keys are generated in RSA.

share|improve this answer
    
So a key cannot be simply copy and pasted back into the new installation on the same machine with the same OS (In this case I am referring to Mac OS X)? –  jason.dot.h Jan 29 '11 at 18:36
1  
yes it can be copy and pasted. ssh is happy as long as the keys are 'valid' - this applies for your personal key. –  silviud Jan 29 '11 at 18:49
add comment

There are multiple algorithms to generate public/private key pairs. You can have a look at RSA and DSA if you are interested.

share|improve this answer
add comment

Generation of ssh keys does depend on the quality of the random number generator provided by the host operating system. If the random number generator is predictable, then it may be possible for a remote attacker to generate the same keys. This problem actually happened:

share|improve this answer
add comment

There's nothing that depends on the underlying host/os/hardware. You can safely transport keys among systems.

Although I would caution against key reuse unless there's a specific need. If you're unsure, you probably don't need it. But if you are sure you won't need further explanation to know why.

share|improve this answer
add comment

puttygen the ssh key generator tool for windows actually lets the user move the mouse cursor randomly within the window to seed the random number generator. this is better than any pure program based generator would do.

terminal based key generators can let the user type random keys on the keyboard in order to seed the random number generator.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.