Question

I’m naive to Git and Linux/SSH so my question is what is the public key is used for?

Nam.

Update

Thanks for @emboss as below answer.
What I’m looking for is that the server need to verify a git client request is from registered account

A registered ones are the accounts whose public key are in the server list 🙂

Thank you emboss!

Answer 1

You normally provide the git server with your public key (e.g. as it is done in github – you first have to send them your public key) first. This is then used by the server for authentication. Once you connect to the git server, you sign a message with your private key. This message is validated by the server with your previously provided public key (cf. RFC 4252 section 7). If the server is able to validate the message with your public key it can be sure that you are indeed the person you claim to be.

On the server side, the public key is also used for authentication purposes. The server typically sends its public key to you once you connect via SSH (for RSA cf. e.g.RFC4432) – this is when you are asked to accept a certain public key fingerprint. If you do accept, during this connection and subsequent connections, the server will use its private key to sign a message for generating a session key (more on that in asecond) that is being sent to you. You try to authenticate this message by using the server’s public key to be sure you are talking to the right server. The message is then used to derive a symmetric encryption key to be used throughout the rest of the session.

The purpose for using symmetric keys to do the actual encryption is simply for reasons of performance, symmetric cryptography is much faster. This implies that the asymmetric public/private keys are merely used for authentication purposes.