0

If a user has an account on an SSH server with a certain public key in its authorized_keys file, and an account on another SSH server B with the same public key in its authorized_keys file, can a third party figure out that these two accounts belong to the same individual?

In this scenario the third party is does not have an account or any sort of access to the servers.

Improve this question
2
  • If they have access to both the files, then yes, of course. Note that even if you SSH into one server one day, then SSH into another server the other day, the two servers can realize you are the same person.
    – forest
    Commented Apr 5, 2018 at 9:44
  • I editted the question. I'm asking about the situation where the third party has no account/access to the servers.
    – user3243135
    Commented Apr 5, 2018 at 9:49

1 Answer 1

Reset to default
1

Yes. Public and private keys are linked in such a way that a certain public key belongs to a certain private key. So if you see two identical public keys you would know that they match to one private key, which likely belongs to one individual.

Improve this answer
3
  • Does the ssh server advertise the user's authorized keys when you attempt to log in via ssh?
    – user3243135
    Commented Apr 5, 2018 at 9:50
  • @user3243135 No, that would allow an attacker to deduce which other servers you have access to. When you start a key-based session, your client first sends its public SSH key to the server. If the server allows you to log in with that public key, it will send you a challenge so you can prove you also own the private key. Guessing public keys is generally not feasible.
    – J.A.K.
    Commented Apr 5, 2018 at 10:00
  • 2
    In theory, you could establish if a user account on a server accepted a public key. That requires the key to be known, but some people use their GitHub public key for SSH authentication on servers, since it's easy to make a script to pull public keys for a GitHub account. So if they've published their key publicly like that, you could present the public key to a server and if it moved to the next phase of the challenge, you'd know it accepts that key.
    – nbering
    Commented Apr 5, 2018 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .