Chapter 5 · Security·v1.0.0·Updated 7/6/2026·~12 min
What's changed: Initial version (topic 1.10, subtopics 1.10.1–1.10.4)
5.3Protecting Data with Encryption
Key points
Learn protecting data and communication with public-key technology: OpenSSH client key management (ssh-keygen, ssh-agent, ssh-add), the major algorithms (RSA, ECDSA, Ed25519), SSH port forwarding (local/remote), and file encryption/signing with GnuPG (gpg, gpg-agent, ~/.gnupg/).
Exam 101 covered connecting with keys; this section goes further—generating and managing keys yourself and applying encryption to both transport (SSH) and files (GnuPG). One principle—the public/private key pair—threads it all.
5.3.1Generating and managing SSH keys
- ssh-keygen generates key pairs (
ssh-keygen -t ed25519). A passphrase encrypts the private key file itself—theft alone is not immediate compromise. - Algorithms: RSA (traditional, most compatible; 3072–4096 bits recommended), ECDSA (elliptic curves—short keys, equal strength), Ed25519 (the current recommendation—fast, safe, compact).
- ssh-agent holds decrypted keys in memory; register with ssh-add and the passphrase is asked once per session, with later connections automatic.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.