11

I have learned there are 2 methods to make SSH remote login easier and secure , those are;

  1. ssh generated keys (using ssh-keygen)OpenSSH Keys

  2. PEM (.pem) keys usually generated with OpenSSL (Amazon Web Services uses this method) OpenSSL

my question is that what are the differences of these 2 methods which one is more secure and why is it more secure ?

12

The file format is different but they both encode the same kind of keys. Moreover, they are both generated with the same code: openssl (the command-line tool) is a wrapper around OpenSSL (the library), and OpenSSH actually uses OpenSSL (the library) for its cryptographic operations, including key pair generation. So there is no direct security difference.

We could argue a bit about password-based encryption of the private keys, but there is nothing really significant here.

  • Something that is confusing me about pem files is that are they the private key? the public key? or both? When we run openssl rsa -in in.pem -pubout out.pub, what does happen under the hood? Is the public key extracted from the PEM file or is the PEM file used to generate a public key? – Behrang Aug 22 '16 at 7:47
  • 2
    "PEM" mostly means "some binary object encoded in Base64, with an explicit header -----BEGIN XXX----- and footer -----END XXX----- that indicates the object type". Private keys are not the only type of data that can use PEM format; e.g. certificates and CRL can too. That being said, most private key format includes a copy of the public key, or the public key can be easily recomputed from the private key, so you can think of "the private key file" as "the file that contains the public and the private key". – Thomas Pornin Aug 22 '16 at 13:53
  • When the PEM file looks like this: -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----, I assume it only contains the private key and when we use openssl rsa -in sample.pem -out sample.pub.der -outform DER -pubout it computes the public key, is that correct? – Behrang Aug 23 '16 at 8:24
3

Assuming you are generating same-size RSA keys for both, there is no difference other than file format. Using one or another will mean absolutely nothing in terms of their effect on security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.