Is it safe to connect to a server with incorrect (confidential) ssh keys?

Question

I have no config file, and every host I connect to, it seems the ssh is going through all of the keys until it finds the correct one.

Is it safe to send the key to the host that's potentially malicious? Like it could be pretending that the key ssh is offering is correct, and like intercept the secret?

---

I guess this kinda answers my question: https://security.stackexchange.com/a/23242 - as in the keys are safe, and I guess the only thing having a lot of keys would do is possibly locking me out if I don't specify which one to use

Answer 1

If you're worried about your private key being compromised, that won't happen. It isn't transmitted.

The public key is, though. I suppose you could identify someone with that, but that only really seems like an issue if you're logging into servers without permission.

Here is a well written post that goes into more detail about how SSH connections work. Relevant excerpt:

The server can use the public key in this file to encrypt a challenge message to the client. If the client can prove that it was able to decrypt this message, it has demonstrated that it owns the associated private key.

Additionally, you cannot get a private key from a public key.

Answer 2

You should be safe to send public keys to untrusted servers; it's a core principle of ssh.

However, this year Qualys discovered a very major vulnerability that allowed a malicious server to steal private keys from a client configured in the default way. This was present for six years.

That specific issue has been fixed now, of course, but it brought to attention the fact that even OpenSSH has vulnerabilities. The fact remains that it is designed to connect safely to potentially malicious servers; whether or not your particular situation requires a stronger guarantee than "should" is something you have to determine yourself.