I'm afraid this is quite a common question, but searching several times through the questions did not prove useful, and I'm really eager of knowledge here :D

I understand that keeping SSH private key well secured (strong passphrase, backup ecc.) is crucial, but I'm wondering about how much having it stolen is dangerous. An eventual attacker, once got our private key, could log into every server which has our public key in authorized_keys, right? But besides that, are there other things that he could use the key for?

  • 11
    Isn't this bad enough?
    – M'vy
    Commented Jun 10, 2015 at 14:47
  • Depends what else is the the key used for. Best place to store your key is a smartcard or something similar.
    – jficz
    Commented Jun 10, 2015 at 15:06
  • @M'vy sure that is bad, I was just curious :D Commented Jun 10, 2015 at 15:09
  • @mikky Can SSH private keys be used for something else? Commented Jun 10, 2015 at 15:10
  • Technically yes, why not. It's (usually) just an RSA key that can be used in any RSA-enabled application.
    – jficz
    Commented Jun 10, 2015 at 15:17

2 Answers 2


Because even if you've secured your private key with a strong passphrase, the passphrase is the only protection of the key.

And since the encrypted key is only one part of an equation (your passphrase is the other half) it only needs enough computation power to bruteforce "crack" that key.

So, the key is as valuable as the passphrase to it.


You could try drawing a mitigation tree where you can visualize the effects of a compromised key on the service environment. Also, you might want to take into account the physical safety of the key itself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .