Editing Authenticator (section)

====Secure Shell====

[[Secure Shell]] (SSH) is a client-server protocol that uses public-key cryptography to create a secure channel over the network. In contrast to a traditional password, an SSH key is a cryptographic authenticator. The primary authenticator secret is the SSH private key, which is used by the client to digitally sign a message. The corresponding public key is used by the server to verify the message signature, which confirms that the claimant has possession and control of the private key.

To avoid theft, the SSH private key (''something that one has'') may be encrypted using a [[passphrase]] (''something that one  knows''). To initiate a two-factor authentication process, the claimant supplies the passphrase to the client system.

Like a password, the SSH passphrase is a memorized secret but that is where the similarity ends. Whereas a password is a shared secret that is transmitted over the network, the SSH passphrase is not shared, and moreover, use of the passphrase is strictly confined to the client system. Authentication via SSH is an example of [[passwordless authentication]] since it avoids the transmission of a shared secret over the network. In fact, SSH authentication does not require a shared secret at all.