Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Keygen – RSA, DSA, Ecdsa, EdDSA

gravitational.com

Post reply on HN
Print view View original

41–45 of 45 posts

Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA

#41

Post by dependenttypes »

aborsy wrote: post #40
dependenttypes wrote: post #34

Earlier quoted context omitted.

> which is kind of on margin even classically Is it though? It requires around 2^128 operations to be broken. It does not seem very marginal to me. It is not like AES where you have to deal with batch-attacks or cryptographic hash functions where collisions for a n-length output require only sqrt(2^n) attempts.

That’s not how it works! That 128 bits is theoretical upper bound, not necessarily an achievable security rate. That’s the point of margin.

Very well, in that case, which symmetric encryption algorithm would you say has an acceptable security margin?

Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA

#42

Post by hal9000-tng »

lervag wrote: post #39
hal9000-tng wrote: post #30

This isn't that complicated. The answer is, simply: ED25519 if you're using modern services that support it. or RSA (4096 or at least 2048 bits) for services that cannot handle ED25519 (including AWS -- yes, still, even in 2020.) So you should probably generate both to cover most possible scenarios: ssh -t ed25519 # for most purposes (not AWS) ssh -t rsa -b 4096 # for when you're not using something like Userify

It should be "ssh-keygen", not "ssh". ssh-keygen -t ed25519 ssh-keygen -t rsa -b 4096

Oops :) thanks for the catch!

Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA

#43

Post by benlivengood »

1vuio0pswjnm7 wrote: post #17
benlivengood wrote: post #14

The only downside to Ed25519 is that it will fall to quantum computing before RSA 4096.

And the only downside to RSA 4096 is that it will fall before Niederreiter using binary Goppa codes?

The upside of RSA is that we'll likely have evidence of ed25519 being breakable (~1500 qubits) before breaking RSA 4096 is possible (~8000 qubits). [https://crypto.stackexchange.com/questions/35137/how-many-qu...]

The number of usable qubits in a single computation is expensive and has been growing slowly and until that changes I figure it's more likely to be surprised by a break of ed25519 but not RSA 4096 than to be surprised by a break of both.

Re: SSH Keygen – RSA, DSA, Ecdsa, EdDSA

#44

Post by brobinson »

pvg wrote: post #32
brobinson wrote: post #24

Earlier quoted context omitted.

This is outdated in terms of recommending bcrypt blindly. Bcrypt has some flaws (leading null bytes, being only "cpu hard") that are addressed by newer hashing functions. Argon2 in independent mode or hybrid mode seems to be the most common recommendation among security luminaries today.

https://news.ycombinator.com/item?id=24286955

Right. I'm not sure "Use X. Use X. Use X. Use X. Use X. Use X. Use X. Use X. Use X." where X is outdated and no longer a best practice is a good template.
Post reply on HN