Question

I am new in Github. I have generated SSH key and now can see it in the SSH Keys. Is it the public or private key?

I have sent the SSH Key (which I saw under SSH Keys) to my client. He asked whether it is public or not? He wants my private key.

Is there any need of Private SSH key? If so, how do I retrieve it?

Answer 1

TL;DR

You can’t retrieve a private key from a GitHub account, but you can if you explicitly add the key file to a published repository. GitHub also limits you to seeing the fingerprint of public keys attached to an account; to my knowledge, you can’t view an account’s public keys on GitHub, either.

Private vs. Public Keys

An SSH public key is stored on a single line, and starts with a key-type field such as ssh-rsa or ecdsa-sha2-nistp256. A private key has multiple lines, and a header that identifies the key block. For example:

—–BEGIN RSA PRIVATE KEY—–

GitHub Only Accepts Public Keys

You can’t actually add a valid private key to a GitHub account anyway. Currently, GitHub only accepts RSA and DSA public keys for this purpose. If you try to add a different key-type, or an invalid public key of any sort, you receive an error like the following:

Key is invalid. It must begin with ‘ssh-rsa’ or ‘ssh-dss’. Check that you’re copying the public half of the key

Private Keys Are Not Stored Server-Side in GitHub Accounts

The upshot of all this is that–quite aside from the fact that you should never store your private keys server-side anyway–it isn’t possible to attach a private key to a GitHub account. Therefore, there’s no way to retrieve the private half of a key-pair from a GitHub account.

Of course, while you can’t add SSH private keys to a GitHub account, you can add them to a published repository. As an example of this, the Vagrant project publishes a full key-pair, but it’s a special case.

Publishing your secret key is inherently insecure. Don’t do it unless you understand the implications.