Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Upgrade Your SSH Key to Ed25519 (2018)

medium.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Upgrade Your SSH Key to Ed25519 (2018)

#31

Post by mileza »

defanor wrote: post #7

> If it was more than five years ago and you generated your SSH key with the default options, you probably ended up using RSA algorithm with key-size less than 2048 bits long. It's closer to 16 years, for OpenSSH [1]. > Open up your terminal and type the following command to generate a new SSH key that uses Ed25519 algorithm: > Generate SSH key with Ed25519 key type That's broken in an amusing way. But speaking of br…

Most of the time it isn't my version on OpenSSH client that limits me but the remote software I'm connecting to. If I can generate an Ed25519 ssh key I will, but most of the time it isn't supported.

I'll usually go with the same order of the preference in the article, Ed25519 then ECDSA then RSA. I haven't yet seen a server not support RSA. But fairly recently I had to register an RSA 4096 on a Bitbucket Server because it did not support both elliptical curve algorithms.

So yeah, it's definitely lacking a lot of software support, but I'll use it if possible.

Re: Upgrade Your SSH Key to Ed25519 (2018)

#32

Post by upofadown »

southerntofu wrote: post #30
upofadown wrote: post #26

>The 1024-bit length is even considered unsafe. Sure in that national level entities could in theory crack 1024 RSA. They would be stupid to tie up such a valuable resource for a year or so on breaking a single SSH connection. They would instead use it on something that got them thousands or even millions of connections. >If it has 3072 or 4096-bit length, then you’re good. Less than that, you probably want to upgrad…

> There is zero evidence It's about being cautious. If we want secure systems for the masses, we need to advance cryptographic defenses faster than we have proofs the attackers are advancing. Most crypto we consider broken today "had zero evidence that anyone would ever break it" before it actually happened...

The aspect here is that we have zero evidence that the next breakthrough would allow the cracking of 2048 bit RSA and not, say, 4096 bit RSA. Chances are, any such breakthrough would allow a more general solution. See quantum computing for an example where this would be true.

The inherent uncertainty of cryptography seems to cause people to want to do something, anything, in an attempt to decrease the uncertainty, even if there is no rational reason behind the approach.

Re: Upgrade Your SSH Key to Ed25519 (2018)

#33

Post by tialaramex »

southerntofu wrote: post #30
upofadown wrote: post #26

>The 1024-bit length is even considered unsafe. Sure in that national level entities could in theory crack 1024 RSA. They would be stupid to tie up such a valuable resource for a year or so on breaking a single SSH connection. They would instead use it on something that got them thousands or even millions of connections. >If it has 3072 or 4096-bit length, then you’re good. Less than that, you probably want to upgrad…

> There is zero evidence It's about being cautious. If we want secure systems for the masses, we need to advance cryptographic defenses faster than we have proofs the attackers are advancing. Most crypto we consider broken today "had zero evidence that anyone would ever break it" before it actually happened...

[Edited: This used to begin "However SSH keys enjoy forward secrecy" but on more consideration that's the wrong way to look at it anyway]

The only role your SSH key plays (which is why you can use Ed25519) is to make signatures. So, if the government discovers next Thursday how to break my archaic RSA key, they don't magically get to read transcripts of SSH sessions they recorded, they only get some sort of attack that could help them to impersonate me on fresh connections after Thursday.

Essentially the authentication step goes like this:

You: I know the private key corresponding to this public key 123456, does that help?

Server: (Examines authorized_keys list) That would work, prove you know that key

You:

Server: Welcome southerntofu

All this is happening inside an encrypted session. Your client (and remote servers) automatically negotiate the safest mutually intelligible session key agreement and encryption to set that up, independent from stuff like your personal keys.

Re: Upgrade Your SSH Key to Ed25519 (2018)

#34

Post by dijit »

nemetroid wrote: post #22
dijit wrote: post #13

Interesting note: Packaged versions of GPG2 did not support ED25519 keys at the time this was written. Additionally some major openpgp packages (notably Golangs) does (or did not) support ED25519 at the time of writing either.[0] This caused the death of a bit of software I was working on because one engineer insisted on using his ED25519 key which my software could not cope with and I was not smart enough to fix it…

Packaged where? Even the two-year-old Ubuntu Xenial had it, from what I can tell.

debian9 has it as a hidden expert option[0] and CENTOS7 doesn't support it at all[1]

[0]: https://debian.pkgs.org/9/debian-main-amd64/gnupg_2.1.18-8~d...

[1]: https://centos.pkgs.org/7/centos-x86_64/gnupg2-2.0.22-5.el7_...

Re: Upgrade Your SSH Key to Ed25519 (2018)

#35

Post by mileza »

southerntofu wrote: post #30
upofadown wrote: post #26

>The 1024-bit length is even considered unsafe. Sure in that national level entities could in theory crack 1024 RSA. They would be stupid to tie up such a valuable resource for a year or so on breaking a single SSH connection. They would instead use it on something that got them thousands or even millions of connections. >If it has 3072 or 4096-bit length, then you’re good. Less than that, you probably want to upgrad…

> There is zero evidence It's about being cautious. If we want secure systems for the masses, we need to advance cryptographic defenses faster than we have proofs the attackers are advancing. Most crypto we consider broken today "had zero evidence that anyone would ever break it" before it actually happened...

I think the same thing about SHA-1. It is possible to generate a collision with it, but it is costly, inefficient and practical.

If you design software, then yes you should put mechanisms in place to replace older and less secure ciphers with new ones, and prefer and limit the ones you chose for some who are considered safe at the moment. But I don't think we should put red flags all over a cipher or a hashing functions because someone with unlimited resources and money managed to fool it once.

Re: Upgrade Your SSH Key to Ed25519 (2018)

#37

Post by 3np »

defanor wrote: post #28
3np wrote: post #23

Earlier quoted context omitted.

> That's broken in an amusing way. Pray tell?

The quoted text is what I saw, with "Generate [...]" in place of a shell command. Found that to be amusing, since it looks like a command, while it isn't the intended one.

Ah, it looks like they fixed it since, thought you were referring to the revised version (:

Re: Upgrade Your SSH Key to Ed25519 (2018)

#38

Post by gorkish »

I will echo the other sentiment here about the lack of support for anything other than RSA keys in various products that have SSH tooling is both maddening and absurd considering that it's just a string that's passed around.

Microsoft Azure, for instance, doesn't support them. Pure idiocy.

Post reply on HN