3

I was wondering about the different types of keys you can create with ssh-keygen -t (dsa | ecdsa | ed25519 | rsa | rsa1). Since different types are offered I assume that each has a specific advantage over the others. Is that true? What are they? And since RSA is the default type (Question 39321), is that one the most secure? Can there be one which is most secure?

4

There isn't one algorithm that's the “most secure”. Once an algorithm has reached the point where it would take either a huge mathematical breakthrough or billions of billions of years of computing power, strength comparisons become meaningless.

The reason why RSA is common is that it's common. It's been around for a long time, so every implementation around supports RSA, so every implementation keeps offering RSA for interoperability.

RSA is secure as long as you choose a large enough key size: 1024 is unbroken but might be broken in a few years by NSA-level attackers; 2048 (the default size for ssh-keygen in current versions of OpenSSH) is safe in the medium term. (RSA1 is an old version of the SSH protocol which has weaknesses and shouldn't be used anymore. It's just about extinct anyway.)

DSA is limited to 1024-bit keys. You generally can't compare key sizes across algorithms, but between DSA and RSA, the strength is about the same. OpenSSH only supports 1024-bit keys because that was the maximum size in the old DSA standard (FIPS 186-2) and the SSH protocol wasn't updated. Since DSA-1024 is considered weak, it's somewhat deprecated, and OpenSSH 7.0 disables it by default in the server configuration (the use of DSA keys in the SSH protocol is called ssh-dss).

ECDSA is a newer family of algorithms; it's significantly faster than RSA or DSA for the same security level, and has smaller keys. ECDSA support is less ubiquitous than RSA, partly because it's newer and partly because of patents on efficient implementation techniques. Any key size supported by OpenSSH is secure.

Ed25519 is a newer alternative to ECDSA. For an end user, it has no significant advantage over ECDSA (for an implementer, it carries less risk of patent infringement). But as it's newer, you may want to connect to machines that don't support it yet; that's less likely with ECDSA.

So the default RSA is fine, but if you use less powerful computers (e.g. low-end smartphone, router, …), prefer ECDSA (or Ed25519) if supported.

4

There is similar answer on Information Security Stackexchange site. In practice, all of them should do their job.

  • RSA is universal and should work everywhere
  • DSA was disabled in recent openssh (7.1) and can perform worse with week random number generator
  • ECDSA is computationally lighter, but you will not notice the difference on today computers. Disadvantage is also fixed length of key (same for DSA).
  • ED25519 is less widespread but shouldn't contain any backdoor by any national agency source question
  • RSA1 is RSA key for old SSHv1 protocol which is obsolete and shouldn't be accepted by any modern server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.