5 ms·

There seems to be some confusion about what the disabling of the "ssh-rsa" public key signature algorithm actually means. This does not mean that you will need

There seems to be some confusion about what the disabling of the "ssh-rsa" public key signature algorithm actually means. This does not mean that you will need to generate new non-rsa keys (although that isn't a bad idea). The on disk key format that you see in your authorized_keys that begins with "ssh-rsa" is just the RSA key (it doesn't encode anything about the hashing algorithm). You will be able to continue to use that key with the "rsa-sha2-256" and "rsa-sha2-512" algorithms. The details of this are outlined in Section 3 of RFC8332[0]. [0]: https://tools.ietf.org/html/rfc8332#section-3 https://tools.ietf.org/html/rfc8332#section-3

GauntletWizard 6y ago
That may be true, but you'll need to update you public key anywhere you use the `ssh-rsa` method; i.e. my github public keys[1] will all need updating. I use this set, statically copied, in most of my various machines and logins. You can generate a `rsa-sha2-512` public key for your existing private key, but for most people the update is less confusing to generate a new key than to use a new private key. Only in scenarios where you have the same private key across several machines do you save any time, and I (and security professionals) have been advising against that for ages. [1] https://github.com/gauntletwizard.keys https://github.com/gauntletwizard.keys
- georgyo 6y ago
  This is not true, for client keys ssh-rsa is just fine. If you're using certificates then you may need to get those resigned. But most people aren't using certificates, just bare rsa keys. And ssh-rsa client keys don't specify a hashing algo at all. Even if you specified `-t rsa-sha2-512` it would still output a ssh-rsa .pub.
- jlgaddis 6y ago
  The section of the RFC linked in the comment you're replying to even explicltly states: > All aspects of the "ssh-rsa" format are kept, including the encoded string "ssh-rsa". This allows existing RSA keys to be used with the new public key algorithms, without requiring re-encoding or affecting already trusted key fingerprints.

GauntletWizard 6y ago

That may be true, but you'll need to update you public key anywhere you use the `ssh-rsa` method; i.e. my github public keys[1] will all need updating. I use this set, statically copied, in most of my various machines and logins. You can generate a `rsa-sha2-512` public key for your existing private key, but for most people the update is less confusing to generate a new key than to use a new private key. Only in scenarios where you have the same private key across several machines do you save any time, and I (and security professionals) have been advising against that for ages. [1] https://github.com/gauntletwizard.keys https://github.com/gauntletwizard.keys

georgyo 6y ago
This is not true, for client keys ssh-rsa is just fine. If you're using certificates then you may need to get those resigned. But most people aren't using certificates, just bare rsa keys. And ssh-rsa client keys don't specify a hashing algo at all. Even if you specified `-t rsa-sha2-512` it would still output a ssh-rsa .pub.
jlgaddis 6y ago
The section of the RFC linked in the comment you're replying to even explicltly states: > All aspects of the "ssh-rsa" format are kept, including the encoded string "ssh-rsa". This allows existing RSA keys to be used with the new public key algorithms, without requiring re-encoding or affecting already trusted key fingerprints.