The ssh-keygen utility generates and manages authentication keys for ssh(1). ssh-keygen defaults to generating an RSA key for use
by protocol 2.0.
Each user wishing to use SSH with RSA or DSA authentication normally runs this once to create the authentication key in $HOME/.ssh/identity or $HOME/.ssh/id_dsa. The system administrator may also use
this to generate host keys.
Ordinarily, this program generates the key and asks for a file in which to store the private key. The public key is stored in a file with the same name but with the ``.pub'' extension appended. The program also asks for a passphrase. The passphrase may be empty to indicate no
passphrase (host keys must have empty passphrases), or it may be a string of arbitrary length. Good passphrases are 10-30 characters long and are not simple sentences or otherwise easy to guess. (English prose has only 1-2 bits of entropy per word, and provides very poor passphrases.) The passphrase can
be changed later by using the -p option.
There is no way to recover a lost passphrase. If the passphrase is lost or forgotten, you will have to generate a new key and copy the corresponding public key to other machines.
For RSA, there is also a comment field in the key file that is only for convenience to the user to help identify the key. The comment can tell what the key is for, or whatever is useful. The comment is initialized to ``user@host''
when the key is created, but can be changed using the -c option.
After a key is generated, instructions below detail where to place the keys to activate them.