On Thu, 8 Jan 2015 09:07:15 +1300, Peter Reutemann wrote:

"The two main concepts are to make the crypto harder and make stealing keys impossible."

-- source: http://it.slashdot.org/story/15/01/07/161227

Also make sure to check that key fingerprint on the initial connection, to forestall man-in-the-middle attacks. The SSH client stores the public keys of hosts you have previously connected to in ~/.ssh/known_hosts. This is a text file you can edit manually, to add a new public key that you have received via a secure channel, say. Alternatively, when you first connect to a new host, you will see a message like The authenticity of host 'hypatia (10.0.0.90)' can't be established. ECDSA key fingerprint is 60:05:2f:dd:3f:73:48:13:88:2f:47:f6:6e:f2:f2:4f. Are you sure you want to continue connecting (yes/no)? (That “ECDSA” might be “DSA” or “RSA” instead, depending on the key algorithm being used.) It is worth checking that the key fingerprint actually matches that for the host key. The corresponding host key file will be /etc/ssh/ssh_host_ecdsa_key.pub (again, “ecdsa” can be replaced with “dsa” or “rsa”, depending on what you saw in the message). To check the fingerprint on the host, use this command (you don’t need to be root to do this): ldo(a)hypatia:~> ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 60:05:2f:dd:3f:73:48:13:88:2f:47:f6:6e:f2:f2:4f /etc/ssh/ssh_host_ecdsa_key.pub (ECDSA) Of course, the person trying to connect isn’t in a position to do this. But someone you trust, who is in such a position, can do this for you. And then the two of you can compare the fingerprints over the phone, say. You don’t have to go through the whole thing, though obviously the more of it you check, the better the confidence you can have in its authenticity.