29

I have learned there are 2 methods to make SSH remote login easier and secure , those are;

  1. ssh generated keys (using ssh-keygen)OpenSSH Keys

  2. PEM (.pem) keys usually generated with OpenSSL (Amazon Web Services uses this method) OpenSSL

my question is that what are the differences of these 2 methods which one is more secure and why is it more secure ?

Improve this question
1

2 Answers 2

Reset to default
24

The file format is different but they both encode the same kind of keys. Moreover, they are both generated with the same code: openssl (the command-line tool) is a wrapper around OpenSSL (the library), and OpenSSH actually uses OpenSSL (the library) for its cryptographic operations, including key pair generation. So there is no direct security difference.

We could argue a bit about password-based encryption of the private keys, but there is nothing really significant here.

Improve this answer
3
  • Something that is confusing me about pem files is that are they the private key? the public key? or both? When we run openssl rsa -in in.pem -pubout out.pub, what does happen under the hood? Is the public key extracted from the PEM file or is the PEM file used to generate a public key?
    – Behrang Saeedzadeh
    Commented Aug 22, 2016 at 7:47
  • 3
    "PEM" mostly means "some binary object encoded in Base64, with an explicit header -----BEGIN XXX----- and footer -----END XXX----- that indicates the object type". Private keys are not the only type of data that can use PEM format; e.g. certificates and CRL can too. That being said, most private key format includes a copy of the public key, or the public key can be easily recomputed from the private key, so you can think of "the private key file" as "the file that contains the public and the private key".
    – Thomas Pornin
    Commented Aug 22, 2016 at 13:53
  • When the PEM file looks like this: -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----, I assume it only contains the private key and when we use openssl rsa -in sample.pem -out sample.pub.der -outform DER -pubout it computes the public key, is that correct?
    – Behrang Saeedzadeh
    Commented Aug 23, 2016 at 8:24
6

Assuming you are generating same-size RSA keys for both, there is no difference other than file format. Using one or another will mean absolutely nothing in terms of their effect on security.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .