Most users would simply type ssh-keygen
and accept what they're given by default.
Yes. To do a security for people, it needs to be simple. Therefore the default option should be safe, compatible and fast. You can provide alternatives, but default should be "good enough" for these who don't care. Therefore RSA (2048) in the old PEM format is the default at the moment.
- Use
-o
for the OpenSSH key format rather than the older PEM format (OpenSSH 6.5 introduced this feature almost 3 years ago on 2014-01-30)
Three years is nothing. A lot of containers managed to evolve during these years, but SSH is here more than 20 years and still needs to deal with older clients. The new OpenSSH format is not widely adopted and supported yet.
- How should one calculate how many rounds of KDF to use with
-a
?
Depends on the use case. Creating your key for your "stuff" repo on Github will be different than creating a keys in your favorite national agency as a certification authority or to access super-secret documents on dedicated server.
As pointed out, this is only for the new format, which is not yet widely used and it increases the time to decrypt key. The default number of rounds is 16
(would be nice to see it documented somewhere). More in the Cryptography question.
- Should
-T
be used to test the candidate primes for safety? What -a
value to use with this?
No. It is used for generating primes (/etc/ssh/moduli
) for DH key exchange. It is not used in any way for generating SSH keys. How to generate and test the moduli
file is explained in separate chapter MODULI GENERATION
of manual page for ssh-keygen
.
- For the different key types, what are the recommended minimum
-b bit
sizes?
This is not SSH specific, but generally key sizes are recommended by NIST in this document, page 12 (per 2015):
RSA (2048 bits)
ECDSA (Curve P-256)
The Ed25519 does have fixed size so the -b
parameter is ignored.
-T
tests probable-primeness not 'safety'; you should never install a moduli file that isn't primes (4) for RSA at least 2048 maybe 3072; for DSA NIST requires group 2048 but also subgroup and hash 224+ and SSH can't handle the latter (yet?); for ECDSA the minimum possible 256 is fine; for Ed25519 there is no choice-T
is:Test DH group exchange candidate primes (generated using the -G option) for safety.
. What is primes(4), and how does one translate this into something that can be typed at a command line (eg, in the RSA case)?-G
THEN-T
and use only the second result. It does produce 'safe' primes (p=2q+1) but 'safe' here is a historical relic, it is nonsmooth prime that matters.