Public Key Authentication

Term: Public Key Authentication

Definition:
Public key authentication is the most secure method for SFTP authentication. Public key authentication uses a pair of computer generated keys – one public and one private. Each key is usually between 1024 and 2048 bits in length, and appears like the sample below. Even though you can see it, it is useless if you don't have the corresponding private key.

Example:
---- BEGIN SSH2 PUBLIC KEY ----
Subject:
Comment: public key
j3KtneI8KnIzFduf08bTD1vauCjhp2RCfjDEkWXINtBsr2qq8J7BYCqoPEmRIUxN
mFD8mSxTWgN3jm6kw5yv5JltzSZIrYAQ9KCWlOU2IW1TlvUGJij4oJJ2JGjig6Qw
3/Koh2CBmVelKz2D+1bibqRN/pq3YtZsMMbO8wJlOp2I0MMRZLgacmyPK8f3Bo/L
nTBXswEvTgsS+O1plW6vCH2gStkG+9iWvlEIeFySijl6rEKjqts0cz5KwDYdPV3i
PsT1xvuvJX7jlLpiDQcna1qQ09jKg6EERi/Eq/loOeE8pmKtx0q6iAH8/10exikQ
K2h0ikjP9hDP//eq8rg49jER1JHrZfQx8NHNQdxsju3j4HfarnlCppbAf8IkclUQ
jnJgVVLfi66EdOkXv+ifJvY3RDzChhF1DG9iMHa1N0+/3B+TUS7/y9cpVlJyNEMI
8jGKLEz3JMypsMTKflJRUf/qt36F06ktwOBlEtGI3pTsR3JPwYp+bUJxPQoJUM3M
CJgyHVFJko86NpneHeqjCwCPaFvFh2YecOE7haXDwWrUQvATdpJBT6U35XiV5jJS
tQCOdhjexlJsxoYlRNM82qHa6oAfGxVyT6sI6XnEfhkf3+d6triEnYQHaxRIRBg4
th5yHi8DGUaKgivqsL167CVEhMFwAQROBs2pKWLeqd2z5xX99ph7SHIBWXP/+Jcf
8L45JEVAFNDzJpl/u0/jC7GcSvjlThMGMe8w0mSPHjtwfkSrIdLXYa9lByZxut1x
yCPbDHQCvn7Bp6AE1gGTlcSlq5T0AjytziJneIwfrMA=
-----END SSH2 PRIVATE KEY-----

Public-private keys are typically generated using a key generation utility. Both keys in the pair are generated at the same time and, while the two are related, a private key cannot be computed from a corresponding public key. In addition to authentication, keys can also be used to sign data. To access an account on a SFTP server, a copy of the client’s public key must be uploaded to the server. When the client connects to the server, it proves that it has the correct key and access is granted.

The private key never leaves the client machine, and therefore cannot be stolen or guessed like a password can. Usually the private key has a “passphrase” associated with it, so even if the private key is stolen, the attacker must still guess the passphrase in order to gain access. Public key authentication does not trust any information from a client or allow any access until the client can prove it has the private key.

Related terms: Public Key Authentication, SFTP, authentication, private key