Stay well away from DSA (“ssh-dss”) keys: they're not just suspect, DSA is insecure.
Ed25519 was developed without any known government involvement.
It is considered suspect (it has known weaknesses and since the US government has been involved in its development, it may be compromised beyond that).
#WHAT IS A GOOD WINDOWS 10 KEYGEN PASSWORD#
A previous man page stated that “the new format has increased resistance to brute-force password cracking.” See this answer for more detail.)ĭo not consider the other new ECC algorithm called ECDSA. Ed25519 requires this new format, so we do not need to explicitly state it given -t ed25519. This dictates usage of a new OpenSSH format to store the key rather than the previous default, PEM. (You may need to omit the -o option since it requires OpenSSH 6.5+ and is the default starting in v7.8, at which point it was removed from the ssh-keygen man page. Large steps were made in 2018, so we're nearly there, but on older systems or for older servers (like CentOS/RHEL < 7 or Ubuntu < 15.04), you can generate a similarly-complex RSA key with 4096 bits: ssh-keygen -t rsa -b 4096 -o -a 100 However, Ed25519 is a rather new key algorithm ( Curve25519's popularity spiked only when it was surmised that other standards had been diluted) and its adoption is not yet universal. The -a 100 option specifies 100 rounds of key derivations, making your key's password harder to brute-force. These have complexity akin to RSA at 4096 bits thanks to elliptic curve cryptography (ECC). I recommend the Secure Secure Shell article, which suggests: ssh-keygen -t ed25519 -a 100Įd25519 is an EdDSA scheme with very small (fixed size) keys, introduced in OpenSSH 6.5 () and made default ("first-preference") in OpenSSH 8.5 ().
0 kommentar(er)
