Previous | Contents | Index | Next Public key authentication is
an alternative means of identifying yourself to a login server,
instead of typing a password. It is more secure and more
flexible, but more difficult to set up. In conventional password
authentication, you prove you are who you claim to be by proving
that you know the correct password. The only way to prove you
know the password is to tell the server what you think the
password is. This means that if the server has been hacked, or
spoofed (see section 2.2), an attacker can learn your password.
Public key authentication solves this problem. You generate a
key pair, consisting of a public key (which everybody is allowed
to know) and a private key (which you keep secret and do not
give to anybody). The private key is able to generate
signatures. A signature created using your private key cannot be
forged by anybody who does not have that key; but anybody who
has your public key can verify that a particular signature is
genuine. So you generate a key