ssh-keygen is a standard component of the Secure Shell (SSH) protocol suite found on Unix and Unix-like computer systems used to establish secure shell sessions between remote computers over insecure networks, through the use of various cryptographic techniques. The ssh-keygen utility is used to generate, manage, and convert authentication keys.
Contents
ssh-keygen is able to generate a key using one of three different digital signature algorithms.
With the help of the ssh-keygen tool, a user can create passphrase keys for any of these key types (to provide for unattended operation, the passphrase can be left empty, at increased risk).
These keys differ from keys used by the related tool GNU Privacy Guard.
Key formats supported
Originally, with SSH protocol version 1 (now deprecated) only the RSA algorithm was supported. As of 2016, RSA is still considered strong, but the recommended key length has increased over time.
The SSH protocol version 2 additionally introduced support for the DSA algorithm. As the DSA algorithm has ties to the American National Security Agency (NSA), aspects of its security have been called into question by Edward Snowden's global surveillance disclosures, particularly in light of the Bullrun decryption program.
Subsequently, OpenSSH added support for a third digital signature algorithm, ECDSA (this key format no longer uses the previous PEM file format for private keys, nor does it depend upon the OpenSSL library to provide the cryptographic implementation). In particular, ECDSA is supported using Curve25519, originally developed by independent cryptography researcher Daniel J. Bernstein.
ssh-keygen command syntax
The syntax of the ssh-keygen file is as follows:
ssh-keygen [options]Some of the important options of ssh-keygen command are as follows:
Files used by the ssh-keygen utility
The ssh-keygen utility uses various files for storing public and private keys. The files used by ssh-keygen utility are as follows: