SSH Explained

SSH authentication uses a pair of encryption keys instead of a password. It’s the recommended way to securely connect to cloud servers and remote Git repositories.

Note: The commands below are the same on Windows, Mac and Linux.

The cheatsheet

1. Generating a key pair

ssh-keygen -t ed25519

• -t flag picks the algorithm, and ed25519 is the most modern of the options.

This command may prompt for an optional passphrase. If provided, you’d need to supply it every time you use the private key. This passphrase acts as a fallback if attackers gained access to your private key file.

2. Finding your new keys

cd ~/.ssh
ls

By default, generated keys are stored in the hidden ~/.ssh folder in your home directory. Navigate there then use ls to list them.

id_ed25519
id_ed25519.pub

The file without an extension is your private key (which you never share with anyone!) The .pub file is the public key. That’s the one you hand to GitHub, GitLab or Bitbucket.

How the SSH handshake works

Both keys are plaintext files holding a long string generated by an encryption algorithm. The Git hosting service stores your public key and uses it to generate a very challenging math problem that cannot be solved without the private key.

To authenticate, your private key is used to solve the challenge and sends back the solution. This proves you hold the matching private key. This is called challenge-response authentication. Nothing secret ever crosses the wire, which is why SSH is considered more secure than using a password.

If this sparks your interest, my friend and security engineer, Bradley Neumaier, wrote a guest post about passwords vs passkeys.

Going further

Each service has its own process for uploading SSH public keys: GitHub, GitLab and Bitbucket.

Once your public key is shared with a Git hosting service, what you’d normally do over HTTPS goes over SSH instead, but SSH isn’t just for Git. Once you interact with more than one remote servers, it’s worth looking into SSH config.