Why does Amazon release private keys instead of public keys

amazon ec2private-keypublic-keysftp

My brain is wrapped around the axle on public and private keys. When you create a cloud server (instance) on Amazon's EC2 service and then want to connect to it via SSH, Amazon requires you to download private a key to make the connection. Doesn't the idea behind public/private key suggest that Amazon should be require you to download a public one?

Further, if I set up an SFTP server for a customer to use, should I be installing their key on the server or giving them a key from the server? In either case, should it be a public or private key?

Best Answer

Thinking more deeply about the authentication process, what needs to be kept secret? Amazon knows the public half of the key, and anybody can know the public half. The public half of the keypair, when matched with the private half, denotes that the private half was used to authenticate.

You private key that is provided to you when Amazon generates a keypair for you is only useful if you're the only one that has it. If it's not a secret, then anybody else who knows it can also authenticate to anybody who holds the public half of the keypair.

Whoever is being authenticated must hold the private half. It's ok if everybody in the world can authenticate you by holding the public half of the key, but only you should be in control of the private half.

Related Solutions

SSH Key – How to Create a Public Key from a Private Key

Use the -y option to ssh-keygen:

ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub

From the 'man ssh-keygen'

 -y      This option will read a private OpenSSH format file and print an
         OpenSSH public key to stdout.

Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains which you used. The newly generated public key should be the same as the one you generated before.

Ssh – Why does a SSH public key sit on the server and not with the client

Keep in mind that the server DOES have a private and public key which is completely separate from the keypair you generate as a user. The private key for the server is usually stored with the server configuration and the public key is transmitted by the server when you attempted to connect. You client compares the server's public key against your known_hosts file. If used properly, this prevents MITM attacks.

You have the private key for your personal account. The server needs your public key so that it can verify that your private key for the account you are trying to use is authorized.

So using your example. Both Bob and Alice have private keys and public keys. The public keys which have been shared before hand or as part of the connection are used to verify the data encrypted by the private keys is legitimate. If the client doesn't have the public key, or has a different public key you will get a scary warning. If the server doesn't have the clients public key, you will not be allowed in.

Best Answer

Related Solutions

SSH Key – How to Create a Public Key from a Private Key

Ssh – Why does a SSH public key sit on the server and not with the client

Related Topic