LX0-104 · Question #280
When using ssh, which of the following can an administrator do to recover a lost passphrase for a DSA or RSA authentication key?
The correct answer is C. A lost passphrase cannot be recovered.. A lost passphrase for an SSH DSA or RSA authentication key cannot be recovered due to the cryptographic design that inherently prevents unauthorized access even if the key file is compromised.
Question
Options
- ARun the ssh-keygen command.
- BRun the ssh --recover command.
- CA lost passphrase cannot be recovered.
- DDecrypt the authentication key with gpg.
- EDecrypt the authentication key with ssh --decrypt.
How the community answered
(14 responses)- C93% (13)
- D7% (1)
Why each option
A lost passphrase for an SSH DSA or RSA authentication key cannot be recovered due to the cryptographic design that inherently prevents unauthorized access even if the key file is compromised.
The `ssh-keygen` command can be used to *change* a passphrase (if the old one is known) or create new keys, but it cannot recover a lost passphrase.
There is no standard `ssh --recover` command or similar functionality in SSH designed to recover a lost passphrase.
SSH key passphrases are not recoverable because they are used to encrypt the private key itself, and the decryption process is irreversible without the original passphrase. For security reasons, there is no backdoor or recovery mechanism built into SSH for lost passphrases.
SSH authentication keys are encrypted using SSH-specific mechanisms, not GPG (GNU Privacy Guard), and GPG cannot decrypt them without the correct method and key.
There is no `ssh --decrypt` command for recovering passphrases; SSH key management tools do not offer such functionality.
Concept tested: SSH key management and security principles
Source: https://man7.org/linux/man-pages/man1/ssh-keygen.1.html
Topics
Community Discussion
No community discussion yet for this question.