It is said in ssh man:

-i identity_file
             Selects a file from which the identity (private key) for public key authentication is read.  The default is
             ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and
             ~/.ssh/id_rsa for protocol version 2.  Identity files may also be specified on a per-host basis in the con‐
             figuration file.  It is possible to have multiple -i options (and multiple identities specified in configura‐
             tion files).  If no certificates have been explicitly specified by the CertificateFile directive, ssh will
             also try to load certificate information from the filename obtained by appending -cert.pub to identity file‐

It states, that identity file is a PRIVATE key.

But doesn't it violates security principle, that private key should be kept in secret?

If ssh transmits the key over network, it can be compromised.

I would expect, that target machine keep private key, and check incoming user's public key.

What is wrong in my understanding?

If ssh is sending private key over network, then what is advantage of it over just using password?

  • 4
    What makes you think it's sending the private key over the network? Commented Nov 4, 2016 at 9:22

1 Answer 1


SSH never sends the private key over the network. This would be, in fact, foolish.

The private key is merely used to answer a "challenge" from the target host which is generated using the corresponding public key. To answer the challenge without possessing the private key is notoriously hard, which makes this sort of communication secure because you cannot break it (in an acceptable time frame) by guessing ie. brute force.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .