1) Why AWS distributes private key instead of public key? for secure communication...
Without the private key, you cannot prove you are the owner of the public key. Without proving you are the owner, you cannot use SSH Public Key Authentication.
So Amazon generates a key itself, and send you. If you don't trust Amazon, you can create another key, put the public key on authorized_keys
and delete the former one.
2) Key pair is mainly to secure communication on the wire, but not authenticate user, to access a resource in AWS.
Not quite. Key pair can surely be used for authentication too. If you sign some data with your private key, someone (or some system) can use your public key to see if you are indeed the one signing the data.
The oversimplification of SSH key authentication is something like this: the client sends the server the key he wants to use to authenticate. If the server have that key on its authorized_keys
file, it will generate a random number, encrypt it with the public key, and send back. If the client really owns the corresponding private key, he can decrypt the file, concatenate with session key (left out for simplicity), hash the result and send to server. Server will have the random number, and the session key. If server hashes both and the result matches what the client sent, the client is the owner of the key and can login.
How does distribution of a key solve authentication problem?
Easy. See above.
Key can be stolen by any wrong person...Why AWS allow ssh login to EC2 without a password?
Because is several orders of magnitude harder to steal a key than to steal a password. If an attacker creates a phishing site to steal your Amazon password and you fall for it, your password is compromised.
If same attacker creates a phishing SSH server to steal your data, it will never steal your private key, as it is never transmitted. He cannot steal anything he doesn't already have (the random number and the session key), and the only borderline sensitive thing he can steal is your public key, and a public key is public anyway.
SSH with the key is the safest way. Passwords can be stolen or leak, but to steal a private key is way harder.