SHA fingerprint mismatch when try to verify SSH key

[ghost]

I thought I'd post this here before submitting a ticket.

I've been trying to add an SSH key to my github account through my Linux terminal. Everything seems to go great until I reach the verification step.

1. The SSH fingerprint that is generated in linux is the same as the SHA fingerprint that shows up in github after I paste in my SSH key
2. But when I go to verify the key, a different SHA fingerprint is generated in linux that doesn't match the orginal one generated in linux or the one in github.
3. Both the generated one and the verified one start with SHA256 but after that they're completely different.

The first time I tried it I mistakenly tried to enter a command in the enter password line. But after entering a few times, it generated an SHA fingerprint. The second time I didn't make the same mistake. The third time I changed my margins to 0 so the SSH key I copied from linux would be all on one line.

I've done some searches around SHA fingerprint mismatches but I don't know enough to know if anything I'm finding holds the answer.

I have a Lenovo duet with an arm processor. I updated and upgraded git prior to generating the SSH key. My current version is 2.30.2.

At this point, I'm not sure what to do or where to look. Any tips would be greatly appreciated. One question I have is can I just ignore the mismatch?

Thank you!

[airtower-luna]

You'll need to share the exact commands you use and their output, and the fingerprints of which keys you're comparing to which. My first guess is that you're comparing the wrong things (you don't need to verify your own key, but you'd have to verify the GitHub server key) but it's impossible to be sure without the details. And for a security question I'd rather not leave it to a guess. 😉

[ghost]

I posted a reply but it didn't show up so this may be a duplicate.

Thank you, airtower-luna. The answer was just as you said - I was comparing wrong things. Here are the steps I took:

To generate an SHA fingerprint, I used the command:
ssh-keygen -t ed25519 -C
(My email address was the last part of the command. Not showing it here.)

I was prompted to enter the file to save the key and then prompted to enter a passphrase. When these steps were completed, an SHA fingerprint was generated and a randomart image.

To get the ssh key, I then used the command:
cat ~/.ssh/id_ed25519.pub

I copied the key that was shown and pasted it into github. Github converted it into an SHA fingerprint. This matched the one generated in Linux.

To verify the key, I used the command:
ssh -T git@github.com

This showed an SHA fingerprint. My mistake was as you said. I was comparing that to the SHA fingerprint related to my ssh key. I see now that I needed to compare it to the public SHA fingerprints. It does match one of those.

Thank you, again. I didn't provide the SHA and ssh information out of concern for security. I see now that I could have simply generated new ones. In the future, it makes sense to go right to a support ticket when security information is required.

[airtower-luna]

This showed an SHA fingerprint. My mistake was as you said. I was comparing that to the SHA fingerprint related to my ssh key. I see now that I needed to compare it to the public SHA fingerprints. It does match one of those.

Excellent. 🙂

I didn't provide the SHA and ssh information out of concern for security. I see now that I could have simply generated new ones.

There is no need for security concern as long as you don't post the private key (that'll be in ~/.ssh/id_ed25519, note the lack of .pub at the end). The public key is just that: public (literally, it's available over the API).

Public key authentication works very differently from using a token or password, where you have to send a secret. Somewhat simplified, in public key authentication you mathematically prove that you control a certain private key by creating a signature over certain data, the private key itself never leaves your device. The public key is needed to check that signature (e.g. the GitHub server does that to decide whether to allow you access), it can't be used to create it. That's why the public key can be public: The worst anyone can do with it is to give you access to their SSH servers, too. And of course that applies to hashes (SHA or otherwise) of the public key, too. 😸

[ghost]

Public key authentication works very differently from using a token or password, where you have to send a secret. Somewhat simplified, in public key authentication you mathematically prove that you control a certain private key by creating a signature over certain data, the private key itself leaves your device. The public key is needed to check that signature (e.g. the GitHub server does that to decide whether to allow you access), it can't be used to create it. That's why the public key can be public: The worst anyone can do with it is to give you access to their SSH servers, too. And of course that applies to hashes (SHA or otherwise) of the public key, too. 😸

Wow. Thanks for this explanation! Now I get it - at least the basic picture. Definitely looking forward to learning more about security!

PS And thanks a million again for your help!

[airtower-luna]

You're welcome! Please don't forget to mark the answer so the thread shows as solved. 😺

Also I added a "never" that's important but I somehow forgot earlier to my explanation, so you might want to check that again. Sorry about that. 😅

[ghost]

Done! And thanks for the clarification!