Keys Are a Tool for your Website Security
You may have noticed that your website hosting has a place to set up public and private keys. If you went through the process, it may seem like you just received a lot of gibberish. That gibberish is an encrypted key. The reason it’s important to your website security is that it can only be decrypted with a very specific second encrypted key.
But, why do you need those keys, anyway? How are they better than a user name and password?
Keys Are Part of Two Security Systems: SSL (aka TLS) and SSH
A viewer interacting with a website and a developer interacting with a server both use keys. But the keys work a bit differently for each situation. Understanding a bit about each situation helps understand how the keys work and why.
What is SSH?
SSH helps protect your website’s file structure and database from being hacked. The original scenario where you might find that your webhost asks you to set up a public – private key is SSH. There are three actions you, or your developer, take on your website:
- Add content or technology to your site. This includes when you first build your site.
- Remove content or technology to your site. This might be removing an out of date plugin so you can switch to one that is no longer out of date.
- Changing software or content. This could be editing misspellings on your site or switching out a photo.
For each of these actions, you have to access the server and make changes to the files and database that are stored on the server. Your web host owns the server and you use the server space they provide. But how does the server know that it’s you, and not a hacker trying to make those changes?
What is SSL?
SSL protects the specific information that passes between your viewer and your website. This information passes when your viewers do one of these actions:
- Read one of your web pages.
- Send you a message through a form.
What is a Public Key
The image of the lock has a key to open it. Depending on what type of lock it is, you may need the key to lock it, or you may be able just to push the post down into the hole and lock it without a key. If you can just push the post down into the hole, locking it is public, anyone can do it. If you need a key to lock it, both the locking and unlocking are private actions.
The second answer is interesting because it goes into the math.
Resources
- For information on the difference between symetric and asymetric:
https://www.ssl2buy.com/wiki/symmetric-vs-asymmetric-encryption-what-are-differences - This is a very good question – answer set on StackOverflow. It considers situations, as well as the technical issues. And, it points out where the idea of a “key” fails. But, first, you may be wondering what public and private keys are, and why they matter.
- https://security.stackexchange.com/questions/233438/what-are-the-logical-steps-taken-to-perform-ssh-key-authentication
- https://blog.invgate.com/what-are-ssh-keys
- https://www.cyberciti.biz/faq/how-to-set-up-ssh-keys-on-linux-unix/
- https://www.ssh.com/academy/pki
- https://en.m.wikibooks.org/wiki/Cryptography/A_Basic_Public_Key_Example
- https://security.stackexchange.com/questions/105331/public-key-private-key-question
- https://security.stackexchange.com/questions/118361/how-are-private-and-public-keys-different