What purpose does an SSH private key passphrase serve?

Question

Let's say you generate an SSH RSA key pair with ssh-keygen -t rsa -b 2048. You'll end up with a public and private key.

• id_rsa
• id_rsa.pub

ssh-keygen will prompt: Enter passphrase (empty for no passphrase):

My understanding is that id_rsa will get one prime and id_rsa.pub will get another prime. What purpose does the passphrase serve? Is the private key locally encrypted with the passphrase?

I notice that the id_rsa file length is a lot longer than that of id_rsa.pub. Is this a byproduct of encryption? Is there more encoded data?

Answer 1

It's an encryption passphrase, and serves as an additional protection against an attacker who compromises your PC's data, buying you some time after the compromise to revoke all your key authorizations.

If, for instance, your laptop gets stolen, and it is running, it is logged-in, or it lacks local encryption, your attacker would, in the absence of a key password, immediately be able to pivot into all SSH servers your laptop is in the authorized_keys of. (The HashKnownHosts directive was introduced in March 2005 to make this pivoting process less trivial, but one's shell history, Git repositories, etc. can still be mined for destinations.)

It does not serve as any extra "authentication", since I believe—other than timing—there's no way for the server to even know that your SSH client happens to use an encrypted keystore. (Unless, of course, your IT administrator is being creative with RMF and is claiming to have implemented "two factor authentication" by mandating SSH keys be encrypted at rest...)

Answer 2

What purpose does the passphrase serve? Is the private key locally encrypted with the passphrase?

The passphrase is derived in a symmetrical key used to encrypt the private key. It can act as a client-side (not the best) second authentication factor (the first one being the possession of the private key file), and to protect the confidentiality of the secret key if it somehow leaks, for example from an unencrypted backup.

I notice that the id_rsa file length is a lot longer than that of id_rsa.pub. Is this a byproduct of encryption? Is there more encoded data?

The public key is also appended to the private key in the id_rsa file. You can recover the public key file with just the private one.

Answer 3

My understanding is that id_rsa will get one prime and id_rsa.pub will get another prime.

Not quite. The public key has a modulus $r$ and an exponent $e$. The private key has the same modulus $r$ and an exponent $d$. They are chosen so that for any $a\leq r$, $$(a^e)^d\equiv a (\mod r)$$

It is possible to deduce $d$ from $e$ (and vice versa) if one knows the prime factors of $r$. We hypothesize that this is the only way of doing it. Since in general it is easy to factorise something that has lots of small prime factors we like to make the prime factors of $r$ as large as possible. Frequently this is described as making $r$ a product of two primes but this is by no means necessary. For example, in implementations where large-number modular arithmetic is much more efficient when the modulus is (say) just under a power of $2$, an implementor could choose to have a third, small prime to get $r$ into that form.

Length of keys

When creating the keys you can choose one of the exponents to be more or less anything you like, and then deduce the other one from it. In particular, you can choose one of them to be very small indeed, since the time taken for exponentiation is affected by the size of the exponent and the number of $1$ bits in it. $3$ and $65537$ are popular choices. Obviously such a short exponent would be easy to guess, so for this reason it is the public key that can benefit from this abbreviation - which, remember, is not mathematically necessary but merely a convenience for the sake of implementation.

So if this is done, the public key (with a very short exponent) will be practically half the length of the private one.

The passphrase

The paraphrase is of no great cryptographic interest. Its sole function is to say “Even if you accidentally let someone have a copy of the private key file, he won’t actually have the private key without guessing the pass phrase”.