So this is something that I'm wondering, how can I have this file in my dotfiles GitHub repo?

I'm sick and tired of having to generate a new SSH key every time I'm on a new computer or re-install my OS etc.

So what's the best way to do this? I imagine assigning the file a passphrase upon the key's generation is enough? That should encrypt it or make it unusable without it. Is this good enough?

If not, is there a way to encrypt the file so that I can safely upload it to the Internet with no worries but can use it at any moment with the correct password?

1 Answer 1


id_rsa.pub is the public key and need not be protected at all. In fact it needs to be published in order to work. I assume you're actually talking about id_rsa (the private key) in this question.

You certainly don't have to generate a new SSH key every time you're on a new computer or re-install your OS. You can copy that file from one computer to another. Or, if you're temporarily on a different computer where you don't want to store your key, you can log in remotely to the computer where the key is stored with ssh -A and load the key into your local agent with ssh-add. (You should only do this if you trust root on the computer you are temporarily using.)

You also should already have a passphrase on your SSH key (if you don't, add one right now, or better yet, consider the key compromised and replace it!), otherwise anyone who even briefly gets access to the computer where the key is stored will have access to it.

If copying the file manually from one computer to another is not convenient for you, you can store your SSH key in the cloud (github or otherwise). Personally, I would prefer not to.

I assume you mean to use a private github repository for this purpose. Although an SSH key with a passphrase should be useless to anyone without the passphrase, you should still keep the encrypted key to yourself, in case someone ever obtains your passphrase.

EDIT: More on sharing id_rsa

Even though id_rsa is unusable to anyone who does not possess the passphrase that goes with it, you should still not share it.

The SSH key can be considered sort of like a form of two-factor authentication. The id_rsa file is Something You Have. The passphrase is Something You Know. Only together are they useful. I say "sort of like" because you don't actually carry around the id_rsa file with you as you would with the Something You Have component of a real 2-factor authentication system.

Not sharing the id_rsa file provides some protection in case your passphrase is revealed to someone else. If that happens, you should definitely revoke the key, but at least there is a chance that an attacker can't do anything if they can't get a copy of id_rsa.

  • That answers my question. :) So if it has a passphrase I can give it to anyone and it wouldn't work for them without the passphrase, correct? Thanks!
    – greduan
    Commented Apr 13, 2013 at 21:05
  • Correct, but I wouldn't tempt fate by doing that. See edits.
    – Celada
    Commented Apr 13, 2013 at 21:09
  • Adding a passphrase to a secret key doesn't make it safe to share! There are a lot of ways to crack the passphrase if you have access to the file Commented Sep 2, 2015 at 7:58
  • @AdonisK. no, adding a good passphrase to a secret key should be very safe. There are certainly not "a lot of ways to crack the passphrase if you have access to the file". If you use a bad passphrase, well... human factors are usually the downfall of crypto, aren't they?
    – Celada
    Commented Sep 2, 2015 at 8:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .