Yesterday I got a new hosting space and when setting up SSH access I noticed they expect me to generate a key pair through a web interface, and then to download the private key and install it on my local system.
My question is, is it safe to transfer private keys over the internet? (of course over an SSL-encrypted connection). I've been told to never do so, as it's technically possible for an attacker to grab it during the transfer.
While the likelihood of it being compromised is small, you're better off generating it locally so that the RSA private key never leaves your system. This way you only have to upload your public key to the server.
I wouldn't be too concerned about the TLS layer and data in transit, but I would be more concerned about private key data being remnant on the server, or cached in your web browser.
It depends on your definition of safe. If have a TLS-secured connection to the administration interface of the hosting service to keep your password (to the same service) safe from third parties, then why not trust it to transmit an SSH key, too. The hosting provider can likely access your server by other means, so the fact that the private key leaks to them, isn't that big of a problem.
However, using an SSH key generated by someone else than you, has the downside that you won't want to use the same key for other services. In a sense, the key would then be tied to the server you are connecting to, instead of the host you are connecting from. The latter would be more usual, and the keys are called "identities" for a reason.
But in any case, it won't matter much, since for a normal SSH server you can change the authorized SSH keys immediately after getting access, so the provider-generated key needs to be valid for only a very short time.
I could guess that the hosting provider implemented it that way so there's no need to teach all users to generate keys for themselves. :)
