Generating 16384 Bit SSH Keys

Re:Generating 16384 Bit SSH Keys by AdamGibbins on Thursday September 27, 2012 @07:31PM (#4583474)

This is a valid point however unfortunately is limited to systems running recent versions of OpenSSH; ECSDA is relatively new. If you connect to a large amount of boxes (as do I), your ECDSA simply will not work on older pre-ECDSA versions of OpenSSH.

That said, nothing preventing you having a mixture of keys for different hosts and modifying your ssh_config to use the correct key dependant on the domain.

[ Parent | on HN ]

Re:Generating 16384 Bit SSH Keys by ComputerGuru on Thursday September 27, 2012 @07:36PM (#4583498)

Small ECDSA key by default, 16kbit RSA fallback?

Both are very secure, but ECDSA will not have the long negotation times. Problem solved?

[ Parent | on HN ]

Re:Generating 16384 Bit SSH Keys by tptacek on Thursday September 27, 2012 @11:13PM (#4584129)

You do not need a 16k RSA key.

[ Parent | on HN ]

Re:Generating 16384 Bit SSH Keys by ComputerGuru on Thursday September 27, 2012 @11:39PM (#4584197)

Or whatever. Just giving an example.

[ Parent | on HN ]

Re:Generating 16384 Bit SSH Keys by newman314 on Friday September 28, 2012 @01:01AM (#4584376)

I have the following in my ssh config file.

  Host *
  IdentityFile ~/.ssh/id_ecdsa
  IdentityFile ~/.ssh/id_rsa
  HashKnownHosts yes
  VisualHostKey yes

[ Parent | on HN ]

Re:Generating 16384 Bit SSH Keys by ars on Thursday September 27, 2012 @07:36PM (#4583497)

Looks like it's from OpenSSH 5.7 released on Jan 25, 2011.

[ Parent | on HN ]

Re:Generating 16384 Bit SSH Keys by AdamGibbins on Thursday September 27, 2012 @07:42PM (#4583516)

Which is unfortunately a very new version compared to most distros. CentOS 6 for example has only 5.3. Debian Squeeze, 5.5. Ubuntu Precise, 5.9.

[ Parent | on HN ]

Re:Generating 16384 Bit SSH Keys by newman314 on Friday September 28, 2012 @12:57AM (#4584369)

Even MacOS Lion does not support ECDSA.

[ Parent | on HN ]