Using certificates for SSH authentication

Using certificates for SSH authentication

Secure passwords have two problems when compared to certificates:

1. They're symmetric keys, not asymmetric. If I can intercept enough of your authentication exchange in the clear to grab your password, that's it - the password is compromised. Certificates are asymmetric keys; the actual authentication exchange is based on using the key to encrypt a random chunk of data, thus demonstrating that you hold the other half of the key, so even if I can intercept the authentication exchange, I can't authenticate as you in future.
2. A good password manager password will use the Base 64 alphabet or similar, for 6 bits per character. That means you need 19 characters of password to match a 2048 bit RSA key or a 224 bit elliptic curve key. To match a 384 bit elliptic curve key (current NSA recommendation for key length until we get post-quantum cryptography), you need a 64 character password. This ends up being a lot larger than most people put in their password manager databases.

The second is easy enough to overcome if you're paying attention - you just ask for very long passwords. The first is not possible to solve - it's inherent in using a shared secret - and means that if you ever send the per-thingie password to the wrong thingie, you have to not only change the password immediately, but also audit the thingie that the password belongs to for attacker behaviour (in case your luck ran out and the attacker was able to read the authentication exchange). With a certificate, this doesn't matter - the authentication exchange isn't enough to pretend to be you.

There's a reason that the big targets (Apple, Google, Facebook etc) are trying to move people to FIDO2 passwordless authentication - this is also a process based on asymmetric encryption, and hence your secret cannot be intercepted.