4 ms·
Forget 16kbits keys. Use this: ssh-keygen -b 521 -t ecdsa That's (a lot) faster than RSA 16384 bit keys. A 200bit ECDSA key is +- (there's many factors invo
by zobzu 14y ago
Forget 16kbits keys.
Use this: ssh-keygen -b 521 -t ecdsa
That's (a lot) faster than RSA 16384 bit keys. A 200bit ECDSA key is +- (there's many factors involved) equivalent to a 2048bit RSA key.
Also the 521bit ECDSA not only verifies faster, it generates instantly (on current hardware), instead of taking a few coffess with the 16K RSA.
Finally, remember that, by the time we've enough computer power to brute force either of the above, one of these will probably happen:
- RSA or ECDSA may be logically broken
- you will be dead
- the hardware and software will not run anymore
- a new computer power breakthrough will make the choice of strength and cipher irrelevant (one can hope)
- AdamGibbins 14y agoThis is a valid point however unfortunately is limited to systems running recent versions of OpenSSH; ECSDA is relatively new. If you connect to a large amount of boxes (as do I), your ECDSA simply will not work on older pre-ECDSA versions of OpenSSH. That said, nothing preventing you having a mixture of keys for different hosts and modifying your ssh_config to use the correct key dependant on the domain.
- ars 14y agoLooks like it's from OpenSSH 5.7 released on Jan 25, 2011.
- AdamGibbins 14y agoWhich is unfortunately a very new version compared to most distros. CentOS 6 for example has only 5.3. Debian Squeeze, 5.5. Ubuntu Precise, 5.9.
- newman314 14y agoEven MacOS Lion does not support ECDSA.
- ComputerGuru 14y agoSmall ECDSA key by default, 16kbit RSA fallback? Both are very secure, but ECDSA will not have the long negotation times. Problem solved?
- tptacek 14y agoYou do not need a 16k RSA key.
- ComputerGuru 14y agoOr whatever. Just giving an example.
- newman314 14y agoI have the following in my ssh config file. Host * IdentityFile ~/.ssh/id_ecdsa IdentityFile ~/.ssh/id_rsa HashKnownHosts yes VisualHostKey yes
- deleted 14y ago[deleted]