5

I was reading over the algoritms used in SSH and I'm trying to figure out which one is the current "recommended" or at least which target audience each is for.

  • Should I make sure my SSH key is 1.0 compatible?
  • Should I use 1024 bit or 2048? Is 2048 twice as slow?
  • Are some better for sensitive uses - while others are for constant data transmission?
Tobu
  • 4,437
  • 1
  • 24
  • 31
Xeoncross
  • 4,449
  • 12
  • 43
  • 56

3 Answers3

4

Don't use 1024 RSA key. Use 2048 or 4096. RSA use only for authentication. Data encrypted with symmetric algorithm(AES, Blowfish, 3DES) with other key. There are no performance differences between 1024 and 2048 key.

Should I make sure my SSH key is 1.0 compatible

Generate RSA keys. You can use the RSA keys for SSH protocol 1 and 2 versions. DSA keys for use only SSH protocol version 2.

ooshro
  • 11,134
  • 1
  • 32
  • 31
  • What do you mean "Data encrypted ... with other key". Are you talking about creating two key pairs? One for login - and the other for data transfer? If so, how would you do that? I though that SSH just used one key. I don't think I need SSH 1.0 for anything so should I use 2048 DSA? – Xeoncross Feb 28 '11 at 01:19
  • RSA encrypt authentication and key exchange. Data transfer key generate before data transfer and key length does not depend on RSA key. – ooshro Feb 28 '11 at 01:39
  • Just for the people which don't want to read the man page of `ssh-keygen`. To generate an 4096 bit RSA key use: `ssh-keygen -Z rsa -b 4096` – Martin Scharrer Apr 23 '16 at 06:45
1

I'll just second ooshro on the cryptography (RSA is used only for key exchange and therefore cheap, I recommend RSA-2048 or above). After that, the encryption ciphers are quite cheap on modern hardware.

On the protocol: just avoid SSH-1, which has some weaknesses.

Tobu
  • 4,437
  • 1
  • 24
  • 31
1

I'll third ooshro and recommend setting a password for the private key as well. It's really not much of a hassle to enter a password for it on the order of once per day, and if your private key is compromised, not all is lost.

Hersheezy
  • 356
  • 1
  • 16