0
$\begingroup$

I recently stumbled apon a though, is there a way to make a website only available to the people that have a public key, just like SSH key authentication, the private key is stored the server, while the public key is stored on the client. When the client tries to connect, the server looks for the public key to see if it is applicable, if it is then the client will be able to see the page, if it isn't, the client would be declined.

Has this already been put to practice, if so, what is it called?

$\endgroup$
  • $\begingroup$ public keys are used only to encrypt, they don't decrypt, so "no"... if you just happen to use the pubkey as a long password, i guess that can work, but there's better ways of authenticating. $\endgroup$ – dandavis Apr 14 '17 at 20:27
2
$\begingroup$

Yes and no.

Yes, there is a public-key SSH-like authentication on the internet which is supported by all major browsers and TLS implementations: TLS client authentication. You just have to specify a list of CAs (possibly your own, non-publicly-trusted CA) that are allowed to issue valid certificates and they and only they are going to yield a successful connection.

However there are drawbacks / little benefits to it which is why it isn't actually deployed usually.


No, it is the client who has to own the private key for authentication. Suppose it was otherwise. Everybody could potentially learn the public key, otherwise it would be just a password. So if everybody can learn it, everybody can use it to impersonate the legitimate client making the entire authentication process completely pointless.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.