Why SSH Key Authentication Beats Password Authentication — What Is Actually Being Proven
"Use key-based auth instead of a password" is common advice for connecting to a server over SSH. But what exactly does key authentication prove, and how does that differ from what a password proves? This post works through the mechanics of what each method is actually demonstrating. Authentication is an act of proof Note: authentication is the process of confirming that whoever just connected…
Password authentication and public-key authentication serve two distinct purposes in the process of confirming a user's identity over SSH. Password authentication involves transmitting the secret directly, while public-key authentication proves possession of a key through a signature. Password authentication is susceptible to dictionary and brute-force attacks, password reuse, and potential exposure of hashed passwords.
In contrast, public-key authentication only sends proof of possession, which can't be reverse-engineered back into the private key. Server-side leaks cost nothing in public-key authentication, as the public key is meant to be public. The client code specifically narrows the authentication to a single key, mitigating the risk of brute-forcing multiple keys.
Eliminating password authentication entirely on the server side is a standard practice, reinforcing the use of public-key authentication. Choosing the appropriate key type in public-key authentication is covered in a separate post.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
