10

Today I generated my first key pair, so my knowledge here is - so to speak - very limited.

On client side I am using Windows and to log in I use PuTTY and I used PuTTYGen to create the keys.

Here (https://winscp.net/eng/docs/ui_puttygen) they say:

If you leave the passphrase fields blank, the key will be saved unencrypted. You should not do this without good reason; if you do, your private key file on disk will be all an attacker needs to gain access to any machine configured to accept that key. If you want to be able to passwordless log in without having to type a passphrase every time, you should consider using Pageant so that your decrypted key is only held in memory rather than on disk.

But here I am failing to see why I should even use RSA rather than regular password authentication when I need to use the passphrase. If I do a passphrase I still need to type in a password when logging in.

On a side I would ask a question about this part:

Pageant so that your decrypted key is only held in memory rather than on disk

Does it really protect anything? I don't know how to read things from memory but isn't it a fairly common thing to do for hackers? To read/replace bits in memory?

Improve this question
2

1 Answer 1

Reset to default
8

You do not need a passphrase for your RSA key. But if your key gets compromised (for example, because you carry the key on a thumb drive and you lose it), an attacker could immediately access the assets the key is protecting.

Using a strong password will give you more time to change keys in case of a key compromise.

Related question on Superuser:

Improve this answer
1
  • 3
    The other advantage of using a password protected key instead of a password alone is that even if an attacker learns your password (perhaps through a keylogger), it's useless to him unless he also steals the key.
    – Johnny
    Commented May 14, 2016 at 22:43

You must log in to answer this question.