5 ms·
> My experience is that a decent number of people still use RSA keys most of the time, but I don't feel like I have nearly enough of a sample size to conclude a
by scrapheap 2y ago
> My experience is that a decent number of people still use RSA keys most of the time, but I don't feel like I have nearly enough of a sample size to conclude anything significant from that.
I wouldn't be surprised if a lot of people still use RSA for SSH keys for one or more of the following reasons:
1. A lot of tutorials about generating SSH Keys were written before ed25519, so if they follow an old tutorial they'll probably be generating an RSA key.
2. Older versions of OpenSSH, that you'd find on CentOS 7 and below, would default to RSA if you didn't specify a key type when running ssh-keygen.
3. There are some systems out there that don't support ed25519, though they are becoming rarer. If you have to deal with those systems then you're forced to use RSA (at least for that system).
4. Some of us have been using SSH keys from way before OpenSSH add support for ed25519 keys in 2014, so any long lived SSH keys won't be ed25519 keys (wow, ed25519 has now been about in OpenSSH for over 10 years).
- miki123211 2y ago5. a lot of people (especially older people I suspect) think "RSA" when they hear "public key cryptography". I'm in my twenties and still have that reaction. I know elliptic curves exist, I even sort-of-kind-of have an awareness of how they work, but if I was asked to name one cryptosystem that used public and private keys, I'd definitely say RSA first and not elliptic curves.
- vitus 2y agoThis is likely in no small part due to CS education only really teaching the mechanics of RSA (modular arithmetic, Fermat's little theorem, etc), or at least, that still seems to be the case at Berkeley. I'd guess because elliptic curve crypto requires more advanced math to reason about (more advanced group theory, at least) and doesn't map as cleanly to existing concepts that non-math-major undergrads have. cryptopals.com also doesn't cover any elliptive curve crypto until you get into the last set.
- throw0101b 2y agoI would think that the (non-EC) Diffie-Hellman would also be easy enough to teach as well: exponentials and discrete log problem aren't any/much complicated than explaining factorization.
- tptacek 2y agoWe didn't even cover RSA until the original last set. It's a build-up. :)
- Spooky23 2y agoIf you interact with government or some large entities that do business with government, they have to comply with FIPS 140-2, and cannot use ed25519.
- vitus 2y ago> If you interact with government or some large entities that do business with government, they have to comply with FIPS 140-2, and cannot use ed25519. Not even when FIPS 140-3 was (finally) finalized in 2019, and testing began in 2020? https://csrc.nist.gov/projects/cryptographic-module-validation-program/sp-800-140-series-supplemental-information/sp800-140c https://csrc.nist.gov/projects/cryptographic-module-validati... includes mentions of EdDSA, and Curve25519 is listed among the "Recommended Curves for U.S. Federal Government Use" on page 15 of https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-186.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S.... (I guess the problem is that various crypto implementations need to get recertified under the new standard...) edit: it looks like AWS-LC [0] and boringcrypto [1] have both been validated under FIPS 140-3. Azure's OpenSSL crypto [2] has only been validated under FIPS 140-2 as far as I can tell. [0] https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4631 https://csrc.nist.gov/projects/cryptographic-module-validati... [1] https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4735 https://csrc.nist.gov/projects/cryptographic-module-validati... [2] https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4496 https://csrc.nist.gov/projects/cryptographic-module-validati...
- devman0 2y agoed25519 is in FIPS 186-5 which meets criteria (a) for Approved Security Functions in FIPS 140-2.
- pantalaimon 2y ago> 3. There are some systems out there that don't support ed25519, though they are becoming rarer. If you have to deal with those systems then you're forced to use RSA (at least for that system). Azure Devops is a big one.
- loudmax 2y agoWhen I run `ssh-keygen`, I can remember the options `-t rsa` or `-t dsa`. I simply cannot remember the flag `-t ed25519`. I have to look it up every time. I just remember the flag as being vaguely similar the name of the monster robot from RoboCop.
- homebrewer 2y agoUse shell autocomplete. Even `bash-completion` suggests arguments for the key type these days: $ ssh-keygen -t <TAB> dsa ecdsa ecdsa-sk ed25519 ed25519-sk rsa `-sk` is short for "security key" if memory serves me right, and is used with FIDO2 hardware tokens.
- throw0101b 2y ago> When I run `ssh-keygen` As of OpenSSH 9.5 the default has changed, so you don't have to specify anything: * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/txt/release-9.5 https://www.openssh.com/txt/release-9.5
- saghm 2y agoOh wow, I didn't know that one! I still manually type `-t ed25519` from muscle memory, I guess I don't have to now