SSH is basically everywhere, and the key generation topic keeps coming regularly. At this point it probably deserves an entry in the Cryptographic Right Answers (https://latacora.micro.blog/2018/04/03/cryptographic-right-a...) to end debates once and for all
SSH Keygen – RSA, DSA, Ecdsa, EdDSA
11–20 of 45 posts
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#12The conclusion has the line: > […] while EdDSA performs much faster and provides the same level of security with significantly smaller keys. For non-embedded systems, how important is the speed and/or size consideration? Keys are (IIRC) only used on initial contact, and the bulk of traffic operations will use symmetrical algorithms, so it it that big of a deal? Perhaps throwing around a comparatively short "id_ed2551…
It can take a surprisingly long time to do the initial exchange on a smart card.
smart card is kind of embedded system by it self.
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#13If you setup SSH keys a while ago, you might want to run the below command to discover the type / key strength. If you're reading HackerNews comments, this might be good time to run an audit. Also; before going all in on Ed25519, native support from some cloud providers is limited. $ for key in ~/.ssh/id_*; do ssh-keygen -l -f "${key}"; done | uniq
There's support in hardware tokens to consider too.
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#14The only downside to Ed25519 is that it will fall to quantum computing before RSA 4096.
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#15The only downside to Ed25519 is that it will fall to quantum computing before RSA 4096.
Except nobody knows when that's gonna really happen. I've personally switched to ed25519-sk wherever I could.
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#16The only downside to Ed25519 is that it will fall to quantum computing before RSA 4096.
Except nobody knows when that's gonna really happen. I've personally switched to ed25519-sk wherever I could.
Same, the short key looks much nicer and both will fall to quantum anyhow. Haven't run into any incompatibilities among the services I use.
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#17The only downside to Ed25519 is that it will fall to quantum computing before RSA 4096.
And the only downside to RSA 4096 is that it will fall before Niederreiter using binary Goppa codes?
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#18It should be noted that EdDSA is generally implemented in constant time, something that can't be said for RSA. (which different implementations - including OpenSSL which OpenSSH uses - have been found to implement it in a way that allows side channel attacks time and time again) In addition I am pretty sure that if you compile OpenSSH with support only for EdDSA it does not need to be linked to OpenSSL.
> In addition I am pretty sure that if you compile OpenSSH with support only for EdDSA it does not need to be linked to OpenSSL.
With the proviso (IIRC) that you will also only have AES-CTR and ChaCha.
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#19It should be noted that EdDSA is generally implemented in constant time, something that can't be said for RSA. (which different implementations - including OpenSSL which OpenSSH uses - have been found to implement it in a way that allows side channel attacks time and time again) In addition I am pretty sure that if you compile OpenSSH with support only for EdDSA it does not need to be linked to OpenSSL.
> In addition I am pretty sure that if you compile OpenSSH with support only for EdDSA it does not need to be linked to OpenSSL. With the proviso (IIRC) that you will also only have AES-CTR and ChaCha.
I do not know about AES but I do know that it also supports Poly1305 to be used with Chacha20.
Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA
#20The only downside to Ed25519 is that it will fall to quantum computing before RSA 4096.
As far as I know elliptic curves at the same size as RSA are stronger both in a quantum and post-quantum setting.