SSH private keys, dangerous to carry around or not. Was Re: Where do you run ssh-keygen

[Nathaniel Homier <nathaniel.homier@bresnan.net>]

Sudev Barar wrote:
> 2008/6/10 Nathaniel Homier <nathaniel.homier@bresnan.net>:
> > > > all is well.  I carry my public and private key on my thumb drive and the
> > > > private key is protected with a passphrase.
> > > Whoops .. do not carry your private key around. No. Keep it somewhere
> > > only you can access and rsik of loosing it is zilch - almost.
> > I have the private key backed up on a desktop computer.  The pass phrase was
> > generated with a high quality pseudo-random number generator using 20
> > characters consisting of letters, numbers and symbols.  The key strength is
> > 4096 and is rsa.
>
> Yes, but if you are carrying private key in your pen drive and you
> loose it or some one copies it your total security is compromised
> howsoever strong encryption algorithm was used to generate the key
> pair.
I was under the impression that the pass phrase encrypted the file and 
that to make use of the private key I would have to supply my pass 
phrase, so I thought the private key was useless without the pass 
phrase.  The 4096 bit just means that it would be pretty much impossible 
with todays tech to brute force the pass phrase, even more so since I 
use 20 characters.  Every time I use the private key I have to supply 
the pass phrase or I won't be able to connect to the ssh server.  But I 
could be wrong.