Contents » Getting Started » Protocols » SSH »

Using Public Keys for Authentication

This article explains public key authentication in general. You may want to see guide to setting up public key authentication instead.

Do not confuse your user key pair used for authentication with host public key verification. Learn about all SSH key types.






So you generate a key pair on your own computer, and you copy the public key to the server under a certain name. Then, when the server asks you to prove who you are, WinSCP can generate a signature using your private key. The server can verify that signature (since it has your public key) and allow you to log in. Now if the server is hacked or spoofed, the attacker does not gain your private key or password; they only gain one signature. And signatures cannot be re-used, so they have gained nothing.


This can make public-key authentication less convenient than password authentication: every time you log in to the server, instead of typing a short password, you have to type a longer passphrase. One solution to this is to use an authentication agent, a separate program which holds decrypted private keys and generates signatures on request. WinSCP can use PuTTY’s authentication agent, called Pageant. When you begin a Windows session, you start Pageant and load your private key into it (typing your passphrase once). For the rest of your session, you can start WinSCP any number of times and Pageant will automatically generate signatures without you having to do anything. When you close your Windows session, Pageant shuts down, without ever having stored your decrypted private key on disk. Many people feel this is a good compromise between security and convenience.

There is more than one public-key algorithm available. The most common are RSA and ECDSA, but others exist, notably DSA (otherwise known as DSS), the USA’s federal Digital Signature Standard.1)

Generating Keys

To generate a key pair, use the PuTTYgen application.

Private Keys

Different file formats are used to store SSH-2 private keys. WinSCP supports PuTTY format, as authors of PuTTY claim that it is the best one.

WinSCP also recognizes (but does not accept) the other two formats (OpenSSH and, and it can convert the keys to PuTTY format for you. To convert the key file you can also use /keygen command-line switch or PuTTYgen application.

  public_key.txt · Last modified: by martin

Search Documentation

This page


About donations

$9   $19   $49   $99

About donations



Site design by Black Gate