Your password is a knowledge factor your SSH key is a possession factor. Software tokens: X.509 certificate, SSH private key.Connected tokens (machine-readable): YubiKey.Disconnected tokens (human-readable): Google Authenticator.Knowledge factors: Password, PIN, secret questions.Wikipedia provides a great list of factors: (They must be different categories a password and a PIN would not be considered 2FA.) Note: The original question talks about 'an SSH key with a Passphrase to login on a server', which I interpreted as a private key, encrypted with a passphrase.ĢFA requires two different factors or categories of authentication. That being said, a private key encrypted with a strong password is often enough. If you want true multi-factor authentication, there are SSH modules that do exactly that. In fact, the server is completely unaware if your private key is protected by a passphrase or not. An attacker that compromises the private key can thus log into your system, even without knowing that passphrase. Are those two factors? No, because the private key can also exist without passphrase. Now imagine your scenario: You have a private key, encrypted with a strong passphrase.

This is often called 'multi-step authentication' instead of 'multi-factor authentication'.

That means your system should stay secure, even if one of the factors is compromised (and you are aware of the compromise).įor example, a door badge and a fingerprint are independent of each other, and just having the door badge or the fingerprint is not enough to gain access.

A second factor is defined as independent of the first factor.

Sublime text sftp passphrase for key