SSH Learning

SSH Key Generation

SSH Topic

Level: Beginner → Advanced

SSH Key Generation is the foundation of modern SSH authentication.

Before you can use:

Public Key Authentication

GitHub SSH Access

Server Login Without Passwords

Automated Deployments

CI/CD Pipelines

Cloud Infrastructure Access

You must know how SSH keys are generated, stored, protected, and managed.

This topic dives deeply into:
ssh-keygen
RSA
ED25519
ECDSA
Passphrases
Fingerprints
Formats
Storage
Security Best Practices

What is SSH Key Generation?
Understanding ssh-keygen
SSH Key Generation Process
RSA Keys
ED25519 Keys
ECDSA Keys
Key Lengths
Passphrases
Key Fingerprints
Key Formats
Key Storage
Best Practices
Internal Architecture
Key Generation Diagrams
Commands
Code Examples
Real-World Examples
Production Examples
Common Mistakes
Troubleshooting
Security Notes
Interview Questions
Hands-On Labs
Exercises
Quiz

1. What is SSH Key Generation?

SSH Key Generation is the process of creating a cryptographic key pair.

Key Pair Components

Private Key

Public Key

Example

Generated Files:

id_ed25519

id_ed25519.pub

Purpose

Used for:

Authentication

Identity Verification

Encryption

Automation

Core Principle

Private Key
     |
Keep Secret

Public Key
     |
Share Freely

High-Level Diagram

ssh-keygen
      |
      +----------------+
      |                |
Private Key      Public Key

2. Understanding ssh-keygen

The primary SSH key generation tool.

What is ssh-keygen?

OpenSSH utility used to:

Generate Keys

Convert Keys

Manage Keys

Create Fingerprints

Create Certificates

Verify Installation

which ssh-keygen

Check Version

ssh -V

Basic Command

ssh-keygen

Typical Output

Generating public/private key pair.

Generated Files

~/.ssh/id_rsa

~/.ssh/id_rsa.pub

~/.ssh/id_ed25519

~/.ssh/id_ed25519.pub

Diagram

ssh-keygen
    |
Random Numbers
    |
Mathematics
    |
Key Pair

3. SSH Key Generation Process

What actually happens internally?

Step 1

Random entropy collected.

Sources:

CPU Events

Kernel RNG

Hardware RNG

Step 2

Cryptographic algorithm selected.

Example:

RSA

ED25519

ECDSA

Step 3

Private key generated.

Step 4

Public key derived.

Step 5

Files written to disk.

Internal Flow

Entropy
   |
Algorithm
   |
Private Key
   |
Public Key
   |
Storage

Result

Key Pair Ready

4. RSA Keys

RSA is one of the oldest SSH key algorithms.

Full Name

Rivest–Shamir–Adleman

Example Generation

ssh-keygen -t rsa

Common Length

ssh-keygen -t rsa -b 4096

Generated Files

id_rsa

id_rsa.pub

Characteristics

Widely Supported

Older Algorithm

Larger Keys

Slower Than ED25519

Diagram

RSA
 |
4096-bit Key
 |
Public Key
 +
Private Key

Production Usage

Still common on:

Legacy Systems

Enterprise Servers

Network Appliances

Advantages

Excellent Compatibility

Disadvantages

Larger Keys

Slower Operations

5. ED25519 Keys

Modern recommended SSH key algorithm.

Example

ssh-keygen -t ed25519

Generated Files

id_ed25519

id_ed25519.pub

Characteristics

Fast

Secure

Small Keys

Modern Design

Recommended By OpenSSH

Yes

Diagram

ED25519
     |
Smaller Keys
     |
Higher Performance

Advantages

Fast Authentication

Small Key Size

Strong Security

Simple Configuration

Recommended Choice

ED25519

for most users.

6. ECDSA Keys

Another elliptic curve algorithm.

Example

ssh-keygen -t ecdsa

Common Sizes

Example

ssh-keygen -t ecdsa -b 521

Generated Files

id_ecdsa

id_ecdsa.pub

Characteristics

Smaller Than RSA

Good Performance

Widely Supported

Comparison

RSA     -> Legacy Standard

ECDSA   -> Modern

ED25519 -> Preferred

7. Key Lengths

Key length affects security.

RSA Lengths

Common:

Example

ssh-keygen -t rsa -b 4096

Security

4096 > 3072 > 2048

Important

Longer key:

More Secure

Slightly Slower

ED25519

Uses fixed length.

No need to specify:

-b

ECDSA

Common:

Key Length Comparison

Algorithm	Typical Length
RSA	4096
ECDSA	256-521
ED25519	Fixed

8. Passphrases

One of the most important security features.

What is a Passphrase?

Extra protection for private keys.

Without Passphrase

Private Key Stolen
     |
Attacker Can Use It

With Passphrase

Private Key Stolen
     |
Passphrase Required

Example

During generation:

Enter passphrase:

Strong Example

Blue!Cloud#Server2026

Weak Example

Diagram

Private Key
      |
Passphrase Encryption
      |
Protected Key

Benefits

Extra Security Layer

9. Key Fingerprints

Fingerprint = unique identifier of a key.

Purpose

Used to verify identities.

Example

SHA256:9x2kL8d...

View Fingerprint

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Output

256 SHA256:abc123...

Why Important?

Verify:

Server Identity

User Identity

Key Authenticity

Diagram

Public Key
     |
Hash Function
     |
Fingerprint

Common Fingerprint Types

SHA256

MD5 (Legacy)

10. Key Formats

SSH keys exist in different formats.

OpenSSH Format

Default modern format.

Example

-----BEGIN OPENSSH PRIVATE KEY-----

PEM Format

Older format.

Example

-----BEGIN RSA PRIVATE KEY-----

Convert Format

ssh-keygen -p -m PEM -f id_rsa

Public Key Format

Example:

ssh-ed25519 AAAAC3Nza...

Format Diagram

Private Key
      |
OpenSSH
PEM
PKCS8

11. Key Storage

Where keys live.

Default Location

~/.ssh/

Example

~/.ssh/
|
+-- id_ed25519
+-- id_ed25519.pub
+-- known_hosts
+-- config

Check Files

ls -la ~/.ssh

Permissions

Directory:

chmod 700 ~/.ssh

Private Key:

chmod 600 ~/.ssh/id_ed25519

Public Key:

chmod 644 ~/.ssh/id_ed25519.pub

Storage Diagram

Home Directory
      |
    .ssh
      |
      +-- Private Keys
      +-- Public Keys
      +-- Config
      +-- Known Hosts

12. Best Practices

Best Practice 1

Use:

ED25519

for new keys.

Best Practice 2

Protect keys with passphrases.

Best Practice 3

Use different keys for:

Work

Personal

Production

Best Practice 4

Rotate old keys.

Best Practice 5

Backup securely.

Best Practice 6

Never share private keys.

Best Practice 7

Remove unused keys.

Best Practice 8

Audit keys regularly.

Recommended Command

ssh-keygen -t ed25519 -C "laptop-2026"

13. Internal Architecture

ssh-keygen
     |
Entropy Collection
     |
Algorithm Selected
     |
Private Key
     |
Public Key Derived
     |
Store in ~/.ssh

14. Key Generation Diagrams

Key Creation

Random Entropy
      |
ssh-keygen
      |
Private Key
      |
Public Key

Authentication Relationship

Private Key
      |
Signs Challenge
      |
Server
      |
Public Key
      |
Verifies Signature

Storage Layout

~/.ssh
 |
 +-- id_ed25519
 +-- id_ed25519.pub

15. Commands

Generate ED25519:

ssh-keygen -t ed25519

Generate RSA:

ssh-keygen -t rsa -b 4096

Generate ECDSA:

ssh-keygen -t ecdsa -b 521

View Fingerprint:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Change Passphrase:

ssh-keygen -p

List Keys:

ls ~/.ssh

16. Code Examples

Generate Production Key:

ssh-keygen -t ed25519 -C "production-admin"

Generate Work Key:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_work

Generate Legacy RSA Key:

ssh-keygen -t rsa -b 4096

Show Fingerprint:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

17. Real-World Examples

GitHub Access

Laptop
 |
SSH Key
 |
GitHub

Cloud Login

Laptop
 |
ED25519 Key
 |
AWS EC2

Developer Environment

Different Keys
for Different Projects

18. Production Examples

Enterprise Environment

Workstation
 |
Production Key
 |
Linux Servers

CI/CD Pipeline

Deploy Key
 |
Automation
 |
Production Server

Kubernetes Administration

Admin Key
 |
Node Login

19. Common Mistakes

Mistake 1

Using no passphrase.

Mistake 2

Sharing private key.

Mistake 3

Storing private key in Git repository.

Mistake 4

Using weak RSA sizes.

Mistake 5

Wrong file permissions.

Mistake 6

Losing private key backup.

Mistake 7

Using same key everywhere.

20. Troubleshooting

Key Not Generated

Verify:

which ssh-keygen

Permission Problems

Fix:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519

Wrong Key Format

Inspect:

file ~/.ssh/id_ed25519

Missing Fingerprint

Check:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Lost Passphrase

Cannot Recover

Generate new key pair.

21. Security Notes

Always use:

ED25519

unless compatibility requires something else.

Use passphrases.

Protect backups.

Never email private keys.

Never upload private keys to GitHub.

Rotate keys periodically.

22. Interview Questions

What command generates SSH keys?

Answer:

ssh-keygen

Which algorithm is recommended today?

Answer:

ED25519

What is a key fingerprint?

Answer:

A unique hash identifying a key.

Why use passphrases?

Answer:

To protect private keys.

Where are SSH keys stored?

Answer:

~/.ssh

23. Hands-On Labs

Lab 1

Generate ED25519 Key

ssh-keygen -t ed25519

Lab 2

Generate RSA 4096 Key

ssh-keygen -t rsa -b 4096

Lab 3

Inspect Generated Files

ls -la ~/.ssh

Lab 4

View Public Key

cat ~/.ssh/id_ed25519.pub

Lab 5

View Fingerprint

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Lab 6

Change Passphrase

ssh-keygen -p

24. Exercises

Exercise 1

Explain the difference between
RSA, ECDSA, and ED25519.

Exercise 2

Describe the SSH key generation process.

Exercise 3

Explain key fingerprints.

Exercise 4

List SSH key storage locations.

Exercise 5

Explain passphrase protection.

25. Quiz

Question 1

Recommended modern SSH key type?

A. DSA
B. RSA 1024
C. ED25519
D. DES

Answer:

Question 2

Command to generate keys?

A. ssh-create
B. ssh-key
C. ssh-keygen
D. keytool

Answer:

Question 3

Where are SSH keys stored?

A. /etc/ssh
B. ~/.ssh
C. /usr/bin
D. /var/log

Answer:

Question 4

Purpose of passphrase?

A. Speed up login
B. Protect private key
C. Replace public key
D. Encrypt server

Answer:

Question 5

Can public keys be shared?

A. No
B. Yes

Answer:

Summary

You should now understand:

✓ ssh-keygen

✓ RSA Keys

✓ ED25519 Keys

✓ ECDSA Keys

✓ Key Lengths

✓ Passphrases

✓ Key Fingerprints

✓ Key Formats

✓ Key Storage

✓ SSH Key Best Practices

✓ Production Key Management

Next Topic:

Topic #9 — SSH Key Files Deep Dive

id_rsa
id_ed25519
.pub Files
authorized_keys
known_hosts
config
Host Keys
File Permissions
Key Protection
Key Lifecycle

SSH Topic

Table of Contents

1. What is SSH Key Generation?

Key Pair Components

Example

Purpose

Core Principle

High-Level Diagram

2. Understanding ssh-keygen

What is ssh-keygen?

Verify Installation

Check Version

Basic Command

Typical Output

Generated Files

Diagram

3. SSH Key Generation Process

Step 1

Step 2

Step 3

Step 4

Step 5

Internal Flow

Result

4. RSA Keys

Full Name

Example Generation

Common Length

Generated Files

Characteristics

Diagram

Production Usage

Advantages

Disadvantages

5. ED25519 Keys

Example

Generated Files

Characteristics

Recommended By OpenSSH

Diagram

Advantages

Recommended Choice

6. ECDSA Keys

Example

Common Sizes

Example

Generated Files

Characteristics

Comparison

7. Key Lengths

RSA Lengths

Example

Security

Important

ED25519

ECDSA

Recommended

Key Length Comparison

8. Passphrases

What is a Passphrase?

Without Passphrase

With Passphrase

Example

Strong Example

Weak Example

Diagram

Benefits

9. Key Fingerprints

Purpose

Example

View Fingerprint

Output

Why Important?

Diagram

Common Fingerprint Types

10. Key Formats

OpenSSH Format

Example

PEM Format

Example