I generated an SSH key pair on my machine, and some other party has my public key. Is there a way for me to prove to the party that I have the corresponding private key? Of course this is possible, since it happens under the hood when making an SSH connection using the key. I am asking if existing tools can be used to perform just the SSH authentication, without giving shell access.
Yes, this is possible. Recent versions of OpenSSH support data signatures. You can do this like the following:
- The other party (the verifier) sends you a random challenge as a file.
- You run
ssh-keygen -Y sign -f ~/.ssh/id_ed25519 -n proof challenge-file(adjusting for key and file name).
- You send
challenge-file.sigto the verifier and tell them to verify with the namespace
- The verifier runs
ssh-keygen -Y verify -n proofwith appropriate arguments to verify the signature.