Public Key Authentication

@amitmund June 25, 2026

SSH Topic

Level: Beginner → Advanced

Public Key Authentication is the most important SSH authentication method used in modern infrastructure.

It is the preferred authentication mechanism for:

  • Linux Servers
  • Cloud Infrastructure
  • DevOps Pipelines
  • Kubernetes Clusters
  • GitHub/GitLab Access
  • Production Environments

Understanding Public Key Authentication is mandatory for every Linux, DevOps, Cloud, Security, and System Administration professional.

Table of Contents

  1. What is Public Key Authentication?
  2. Why Public Key Authentication Exists
  3. Public Key Cryptography Fundamentals
  4. Private Keys
  5. Public Keys
  6. Key Pairs
  7. Challenge-Response Authentication
  8. authorized_keys
  9. SSH Key Verification
  10. Key-Based Login Flow
  11. Security Advantages
  12. Key Management
  13. Key Authentication Debugging
  14. Internal Architecture
  15. Authentication Diagrams
  16. Commands
  17. Code Examples
  18. Real-World Examples
  19. Production Examples
  20. Common Mistakes
  21. Troubleshooting
  22. Security Notes
  23. Interview Questions
  24. Hands-On Labs
  25. Exercises
  26. Quiz

1. What is Public Key Authentication?

Public Key Authentication is an SSH authentication method where:

Client proves ownership
of a private key
without ever sending
the private key to the server.

Traditional Password Authentication

User
 |
Password
 |
Server
 |
Verification

Public Key Authentication

Private Key
      |
Challenge
      |
Cryptographic Proof
      |
Authentication Success

Main Goal

Answer:

Can this user prove ownership
of the correct private key?

Why Important?

Modern production servers often disable:

Password Authentication

and allow only:

Public Key Authentication

Example Login

ssh user@server

No password required.

Authentication occurs using keys.

2. Why Public Key Authentication Exists

Passwords have weaknesses.

Password Problems

Weak Passwords

Password Reuse

Brute Force Attacks

Phishing

Credential Theft

Public Key Authentication Solves

No Password Transmission

Stronger Authentication

Automation Friendly

More Secure

Harder to Attack

Comparison

Feature Password Public Key
Guessable Yes No
Brute Force Risk High Very Low
Automation Poor Excellent
Security Medium High
Production Usage Rare Common

3. Public Key Cryptography Fundamentals

SSH uses:

Asymmetric Cryptography

Meaning

Two keys exist:

Public Key

Private Key

Important Rule

Public Key
Can Be Shared

Private Key
Must Remain Secret

Analogy

Think of:

Public Key = Padlock

Private Key = Only Key

Diagram

Public Key
     |
Can Be Shared
     |
Anyone Can See

Private Key
     |
Must Be Protected
     |
Owner Only

Core Principle

Data encrypted
with one key

Can only be verified
using the matching key.

4. Private Keys

The most important SSH asset.

Definition

Private key is a secret cryptographic key stored on the client.

Common Files

~/.ssh/id_rsa

~/.ssh/id_ed25519

~/.ssh/id_ecdsa

Example

ls ~/.ssh

Output:

id_ed25519
id_ed25519.pub

Which File Is Private?

id_ed25519

Permissions

Must be protected.

Example:

chmod 600 ~/.ssh/id_ed25519

Diagram

Laptop
 |
Private Key
 |
Never Leaves Device

Critical Rule

Never Share
Private Keys

5. Public Keys

Public key is derived from private key.

Example

id_ed25519.pub

View Public Key

cat ~/.ssh/id_ed25519.pub

Example Output

ssh-ed25519 AAAAC3Nza...

Can Public Keys Be Shared?

Yes

Purpose

Server stores public key.

Diagram

Private Key
      |
Generate
      |
Public Key

Important

Public key alone:

Cannot Log In

Cannot Reveal
Private Key

6. Key Pairs

SSH keys always exist as a pair.

Components

Private Key

Public Key

Generated Together

Command:

ssh-keygen

Example

ssh-keygen -t ed25519

Generated Files

id_ed25519

id_ed25519.pub

Relationship

Private Key
     |
Mathematical Pair
     |
Public Key

Diagram

ssh-keygen
     |
     +----------------+
     |                |
Private Key     Public Key

Important

Losing the public key:

Recoverable

Losing the private key:

Authentication Impossible

7. Challenge-Response Authentication

This is how SSH proves identity.

Goal

Server must verify:

Client owns
matching private key

Without Sending It

Private Key Never Travels
Across Network

Authentication Flow

Step 1:

Server sees:

Public Key Available

Step 2:

Server creates challenge.

Step 3:

Client signs challenge.

Using:

Private Key

Step 4:

Server verifies signature.

Using:

Public Key

Step 5:

Authentication succeeds.

Diagram

Server
 |
Challenge
 |
Client
 |
Sign Challenge
Using Private Key
 |
Server
 |
Verify Signature
Using Public Key
 |
Success

Simplified Example

Server:
Prove You Own Key

Client:
Signed Proof

Server:
Verified

Important

Private key is never transmitted.

8. authorized_keys

One of the most important SSH files.

Location

~/.ssh/authorized_keys

Purpose

Stores public keys allowed to log in.

Example

cat ~/.ssh/authorized_keys

Output:

ssh-ed25519 AAAAC3...
ssh-rsa AAAAB3...

Authentication Logic

Public Key Exists?

Yes
 |
Continue

No
 |
Reject Login

Flow

Client Public Key
        |
Server authorized_keys
        |
Match Found?
        |
Authentication Allowed

Permissions

Directory:

chmod 700 ~/.ssh

File:

chmod 600 ~/.ssh/authorized_keys

Common Mistake

Wrong permissions.

Results in:

Permission denied (publickey)

9. SSH Key Verification

Server must verify:

Client Public Key
Matches
Stored Public Key

Process

Client Sends Public Key
          |
Server Searches
authorized_keys
          |
Match Found
          |
Challenge-Response
          |
Success

No Match

Permission denied
(publickey)

Verification Diagram

Client Key
     |
authorized_keys
     |
Match?
  /     \
Yes      No
 |        |
Allow   Deny

10. Key-Based Login Flow

Complete login process.

Step 1

User runs:

ssh user@server

Step 2

SSH connection established.

Step 3

Server requests authentication.

Step 4

Client offers public key.

Step 5

Server finds matching key.

Step 6

Challenge created.

Step 7

Client signs challenge.

Step 8

Server verifies signature.

Step 9

Authentication succeeds.

Step 10

Shell created.

Complete Flow

Client
 |
Public Key Offered
 |
Server
 |
authorized_keys Match
 |
Challenge
 |
Signature
 |
Verification
 |
Success
 |
Shell

11. Security Advantages

Public Key Authentication offers major security benefits.

Benefit 1

No password transmission.

Benefit 2

Immune to password guessing.

Benefit 3

Supports automation.

Benefit 4

Supports passphrases.

Benefit 5

Supports hardware tokens.

Benefit 6

Supports MFA.

Benefit 7

Difficult to brute force.

Security Comparison

Password Security
       |
Medium

SSH Key Security
       |
High

12. Key Management

Managing keys properly is essential.

Generate Key

ssh-keygen -t ed25519

Copy Public Key

ssh-copy-id user@server

Remove Old Keys

Edit:

~/.ssh/authorized_keys

Backup Keys

Store securely.

Rotate Keys

Periodically replace keys.

Naming Keys

Example:

id_ed25519_work

id_ed25519_prod

id_ed25519_lab

Recommended Layout

~/.ssh/
 |
 +-- id_ed25519
 +-- id_ed25519.pub
 +-- authorized_keys
 +-- known_hosts

13. Key Authentication Debugging

One of the most important real-world skills.

Verbose Logging

ssh -v user@server

More Detail

ssh -vv user@server

Maximum Detail

ssh -vvv user@server

Example Output

Offering public key

Server accepts key

Authentication succeeded

Common Failure

Permission denied
(publickey)

Check Key Permissions

ls -la ~/.ssh

Check Server Logs

Ubuntu:

sudo tail -f /var/log/auth.log

RHEL:

sudo tail -f /var/log/secure

Validate SSH Configuration

sudo sshd -t

14. Internal Architecture

Client
 |
Private Key
 |
SSH
 |
Encrypted Connection
 |
SSHD
 |
authorized_keys
 |
Challenge Verification
 |
Authentication Success

15. Authentication Diagrams

Key Generation

ssh-keygen
     |
     +------+
     |      |
Private   Public
 Key       Key

Authentication

Client
 |
Private Key
 |
Sign Challenge
 |
Server
 |
Public Key
 |
Verify Signature
 |
Success

Storage

Client Machine
 |
id_ed25519

Server
 |
authorized_keys

16. Commands

Generate Key:

ssh-keygen -t ed25519

Copy Key:

ssh-copy-id user@server

View Public Key:

cat ~/.ssh/id_ed25519.pub

View Authorized Keys:

cat ~/.ssh/authorized_keys

Debug Authentication:

ssh -vvv user@server

Check Permissions:

ls -la ~/.ssh

17. Code Examples

Generate Key Pair:

ssh-keygen -t ed25519 -C "my-laptop"

Install Public Key:

ssh-copy-id user@server

Login:

ssh user@server

Specify Key:

ssh -i ~/.ssh/id_ed25519 user@server

18. Real-World Examples

Developer Laptop

Laptop
 |
Private Key
 |
GitHub
 |
Public Key

System Administrator

Laptop
 |
SSH Key Login
 |
Linux Servers

19. Production Examples

AWS

EC2 Instance
 |
authorized_keys
 |
SSH Key Authentication

Kubernetes

Admin Workstation
 |
SSH Keys
 |
Cluster Nodes

CI/CD

GitHub Actions
 |
Deploy Key
 |
Production Server

20. Common Mistakes

Mistake 1

Sharing private keys.

Mistake 2

Wrong permissions.

Mistake 3

Storing private keys in Git.

Mistake 4

Using RSA when organization requires ED25519.

Mistake 5

Deleting private key accidentally.

21. Troubleshooting

Permission Denied (publickey)

Check:

ssh -vvv user@server

Wrong Permissions

Fix:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Key Not Offered

Specify:

ssh -i ~/.ssh/id_ed25519 user@server

Key Missing

Verify:

ls ~/.ssh

Server Rejecting Key

Check:

cat ~/.ssh/authorized_keys

22. Security Notes

Never share:

Private Keys

Always protect keys with:

Strong Passphrase

Use:

ED25519

when possible.

Rotate old keys.

Remove unused keys.

Audit:

authorized_keys

regularly.

23. Interview Questions

Q1

What is the difference between
a public key and private key?

Answer:

Public key is shared.
Private key remains secret.

Q2

Where are allowed public keys stored?

Answer:

~/.ssh/authorized_keys

Q3

Does the private key travel
across the network?

Answer:

No

Q4

What command generates SSH keys?

Answer:

ssh-keygen

Q5

What causes
Permission denied (publickey)?

Answer:

Key mismatch
Wrong permissions
Missing key

24. Hands-On Labs

Lab 1

Generate ED25519 Key

ssh-keygen -t ed25519

Lab 2

Inspect Generated Files

ls ~/.ssh

Lab 3

View Public Key

cat ~/.ssh/id_ed25519.pub

Lab 4

Install Public Key

ssh-copy-id user@server

Lab 5

Login Using Key

ssh user@server

Lab 6

Debug Authentication

ssh -vvv user@server

25. Exercises

Exercise 1

Explain public/private key pairs.

Exercise 2

Describe challenge-response authentication.

Exercise 3

Explain the purpose of authorized_keys.

Exercise 4

List security advantages of key authentication.

Exercise 5

Describe the complete key-based login flow.

26. Quiz

Question 1

Which file contains the private key?

A. id_ed25519.pub
B. authorized_keys
C. id_ed25519
D. known_hosts

Answer:

C

Question 2

Which file stores allowed public keys?

A. known_hosts
B. authorized_keys
C. passwd
D. shadow

Answer:

B

Question 3

Which command generates keys?

A. ssh-key
B. keygen
C. ssh-keygen
D. ssh-create-key

Answer:

C

Question 4

Does the private key leave the client?

A. Yes
B. No

Answer:

B

Question 5

Preferred modern SSH key type?

A. DSA
B. ED25519
C. DES
D. MD5

Answer:

B

Summary

You should now understand:

✓ Public Key Authentication

✓ Private Keys

✓ Public Keys

✓ Key Pairs

✓ Challenge-Response Authentication

✓ authorized_keys

✓ SSH Key Verification

✓ Key-Based Login Flow

✓ Security Advantages

✓ Key Management

✓ Key Authentication Debugging

✓ Production SSH Authentication

Next Topic:

Topic #8 — SSH Key Generation

ssh-keygen
RSA Keys
ED25519 Keys
ECDSA Keys
Key Lengths
Passphrases
Key Fingerprints
Key Formats
Key Storage
Best Practices
0 Likes
35 Views
0 Comments

Filters

No filters available for this view.

Reset All