3 ms·
This is a valid point however unfortunately is limited to systems running recent versions of OpenSSH; ECSDA is relatively new. If you connect to a large amount
by AdamGibbins 14y ago
This is a valid point however unfortunately is limited to systems running recent versions of OpenSSH; ECSDA is relatively new. If you connect to a large amount of boxes (as do I), your ECDSA simply will not work on older pre-ECDSA versions of OpenSSH.
That said, nothing preventing you having a mixture of keys for different hosts and modifying your ssh_config to use the correct key dependant on the domain.
- ars 14y agoLooks like it's from OpenSSH 5.7 released on Jan 25, 2011.
- AdamGibbins 14y agoWhich is unfortunately a very new version compared to most distros. CentOS 6 for example has only 5.3. Debian Squeeze, 5.5. Ubuntu Precise, 5.9.
- newman314 14y agoEven MacOS Lion does not support ECDSA.
- ComputerGuru 14y agoSmall ECDSA key by default, 16kbit RSA fallback? Both are very secure, but ECDSA will not have the long negotation times. Problem solved?
- tptacek 14y agoYou do not need a 16k RSA key.
- ComputerGuru 14y agoOr whatever. Just giving an example.
- newman314 14y agoI have the following in my ssh config file. Host * IdentityFile ~/.ssh/id_ecdsa IdentityFile ~/.ssh/id_rsa HashKnownHosts yes VisualHostKey yes