4 ms·

> If it was more than five years ago and you generated your SSH key with the default options, you probably ended up using RSA algorithm with key-size less than

> If it was more than five years ago and you generated your SSH key with the default options, you probably ended up using RSA algorithm with key-size less than 2048 bits long. It's closer to 16 years, for OpenSSH [1]. > Open up your terminal and type the following command to generate a new SSH key that uses Ed25519 algorithm: > Generate SSH key with Ed25519 key type That's broken in an amusing way. But speaking of broken things, gnome-keyring didn't support ECC for SSH the last time I've checked (a few years ago), and was/is breaking GPG too [2]. Then there are servers with old systems not supporting Ed25519 (it was added in OpenSSH version 6.5, just in 2014 [3]). The situation with smart card support wasn't quite clear the last I've checked, either. Besides, ECC was thought to be more resistant to quantum computing attacks, but not anymore (and seems to be an easier target at regular key sizes, actually) [4], so it lost some of the appeal. Ed25519 still seems nice, but perhaps one shouldn't hurry to switch to it -- especially if the software support isn't great, and/or there are other difficulties. [1] https://www.openssh.com/txt/release-4.2 https://www.openssh.com/txt/release-4.2 [2] https://wiki.gnupg.org/GnomeKeyring https://wiki.gnupg.org/GnomeKeyring [3] https://www.openssh.com/txt/release-6.5 https://www.openssh.com/txt/release-6.5 [4] https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Quantum_computing_attacks https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Qu...

zaarn 5y ago
In my experience, software support is pretty wide. I do have an RSA key in case the ed25519 isn't accepted but I think it's been a year since I've had to use it. The much nicer part about Ed25519 is that you can realistically type it out over a serial console or over a monitor-keyboard without access to copy-paste directly. They're small and fast and convenient. In addition to that, the cryptography behind Ed25519 is much simpler to implement than RSA without causing massive side channel leaks, so that is one less thing to worry about. In terms of Anti-QC Resistance, I wouldn't worry about it until we complete the current qc-resistant crypto competition, which should give us a nice set of primitives to use.
3np 5y ago
> That's broken in an amusing way. Pray tell?
- defanor 5y ago
  The quoted text is what I saw, with "Generate [...]" in place of a shell command. Found that to be amusing, since it looks like a command, while it isn't the intended one.
  - 3np 5y ago
    Ah, it looks like they fixed it since, thought you were referring to the revised version (:
nyuszika7h 5y ago
gnome-keyring on Ubuntu 21.04 supports my ed25519 SSH key just fine.
- defanor 5y ago
  Good, apparently it was fixed in 2018 [1]. [1] https://bugzilla.gnome.org/show_bug.cgi?id=723274 https://bugzilla.gnome.org/show_bug.cgi?id=723274
mileza 5y ago
Most of the time it isn't my version on OpenSSH client that limits me but the remote software I'm connecting to. If I can generate an Ed25519 ssh key I will, but most of the time it isn't supported. I'll usually go with the same order of the preference in the article, Ed25519 then ECDSA then RSA. I haven't yet seen a server not support RSA. But fairly recently I had to register an RSA 4096 on a Bitbucket Server because it did not support both elliptical curve algorithms. So yeah, it's definitely lacking a lot of software support, but I'll use it if possible.

zaarn 5y ago

In my experience, software support is pretty wide. I do have an RSA key in case the ed25519 isn't accepted but I think it's been a year since I've had to use it. The much nicer part about Ed25519 is that you can realistically type it out over a serial console or over a monitor-keyboard without access to copy-paste directly. They're small and fast and convenient. In addition to that, the cryptography behind Ed25519 is much simpler to implement than RSA without causing massive side channel leaks, so that is one less thing to worry about. In terms of Anti-QC Resistance, I wouldn't worry about it until we complete the current qc-resistant crypto competition, which should give us a nice set of primitives to use.

3np 5y ago

> That's broken in an amusing way. Pray tell?

defanor 5y ago
The quoted text is what I saw, with "Generate [...]" in place of a shell command. Found that to be amusing, since it looks like a command, while it isn't the intended one.
- 3np 5y ago
  Ah, it looks like they fixed it since, thought you were referring to the revised version (:

nyuszika7h 5y ago

gnome-keyring on Ubuntu 21.04 supports my ed25519 SSH key just fine.

defanor 5y ago
Good, apparently it was fixed in 2018 [1]. [1] https://bugzilla.gnome.org/show_bug.cgi?id=723274 https://bugzilla.gnome.org/show_bug.cgi?id=723274

mileza 5y ago

Most of the time it isn't my version on OpenSSH client that limits me but the remote software I'm connecting to. If I can generate an Ed25519 ssh key I will, but most of the time it isn't supported. I'll usually go with the same order of the preference in the article, Ed25519 then ECDSA then RSA. I haven't yet seen a server not support RSA. But fairly recently I had to register an RSA 4096 on a Bitbucket Server because it did not support both elliptical curve algorithms. So yeah, it's definitely lacking a lot of software support, but I'll use it if possible.