What are SSH keys?

SSH keys are one of the most secure ways to access a server since they require authentication beyond a simple password. SSH keys are harder to crack and much easier to use than passwords, which makes them the default choice for the SSH protocol. However, to achieve these benefits, organizations must introduce proper SSH key management.

What is SSH?

Secure Socket Shell (SSH), also known as simply Secure Shell, is a cryptographic protocol, primarily used to enable secure access to remote servers and devices over the internet. It operates on public-key cryptography that provides a mechanism for mutual authentication between the server and the client and establishes an encrypted channel of communication between them over an unsecured network.

SSH is widely used to enable the following functions:

• Secure access to remote systems
• Secure execution of commands on remote systems
• Secure remote delivery of software updates
• Secure interactive and automated file transfers
• Auto-login to servers
• Secure management of critical network infrastructure systems such as routers, firewalls, servers, virtual machines, operating systems, and more.

SSH is usually enabled on most operating systems. It is enabled by default on Linux, Unix, and macOS. SSH connections can be initiated directly through the terminal program. However, on Windows OS, SSH connections must be initiated with an SSH client program. Some of the popular client programs available today are PuTTY, wolfSSH, and SecureCRT.

What are SSH keys?

SSH keys are a pair of public and private keys that are used to authenticate and establish an encrypted communication channel between a client and a remote machine over the Internet.

How Does Authentication Work? 

The SSH key pair is used to authenticate the identity of a user or process that wants to access a remote system using the SSH protocol. The public key is used by both the user and the remote server to encrypt messages. On the remote server side, it is saved in a file that contains a list of all authorized public keys. On the user’s side, it is stored in SSH key management software or in a file on their computer. The private key remains only on the system being used to access the remote server and is used to decrypt messages.

When a user or process requests a connection to the remote server using the SSH client, a challenge-response sequence is initiated to complete authentication. The SSH server recognizes that a connection is being requested and sends an encrypted challenge request using the shared public key information. The SSH client then decrypts the challenge message and responds back to the server. The user or process must respond correctly to the challenge to be granted access. This challenge-response sequence happens automatically between the SSH client and server without any manual action by the user.

SSH Key Authentication vs. Passwords

At a high level, SSH keys function like passwords by controlling access. But that’s where the similarity ends. Digital identities need to be strong so that they cannot be stolen, convenient so that access is fast and never interrupted, and future-proof so that enterprises can stay ahead of threats.

Passwords are used to offer a measure of security, but they are not as effective as they once were. That’s because bad actors have become increasingly adept at stealing passwords in transit through the internet, lifting them from repositories, and obtaining them through brute force attacks.

These issues are compounded by the human factor: that people reuse, share, and continually forget passwords. The cost to businesses is high, not only because of data loss, outages, and the compromise of information, but also because passwords take time to enter, require significant support resources, and must be frequently reset.

Using PKI’s cryptographic strength and authentication methods, SSH keys are not prone to malicious attacks, and valid credentials are not exposed if a system or server has been compromised. PKI cryptography is being improved continuously, future-proofing identities against new and evolving threats. SSH key authentication is more convenient than password authentication. The keys connect users and processes to a server by initiating authentication and granting access automatically, so users don’t have to remember or enter their password for each and every system.

SSH keys are a critical access management problem

Since SSH is the primary secure access method used for administration and automated processes on mission-critical systems, its security is crucial. The privileges granted to users and automated processes via SSH are typically elevated privileges. The security of SSH-based automated access, and even interactive access, has been largely ignored to date. Over the last few years, it has turned out that many large-scale organizations, ranging from the banking sector and healthcare organizations to big retailers, have massive numbers of SSH keys in their environment. These keys grant access to resources such as production servers, databases, routers, firewalls, disaster recovery systems, financial data, payment systems, intellectual property, and patient information. Users have been able to create and install keys without oversight and controls. This has led to violations of corporate access policies and dangerous backdoors which in turn facilitate the launch of successful attacks through the otherwise trusted encrypted tunnels.

Information security starts from controlling who is given access to systems and data. If there is no control over access, there is no security, no confidentiality, no integrity, and no guarantees of continued operation.