When I generate RSA key for ssh (both server-side and client-side):
dpkg-reconfigure openssh-server
ssh-keygen
the key generation is completed instantly. However, when I generate RSA key for gpg, the key generation takes several minutes and I have to generate entropy by typing on the keyboard or reading/writing to the disk:
gpg --key-gen
I am wondering what makes this difference, and whether the quality of the generated keys is the same (for the same key size). Has anybody anything to say about this?
as a side-note:
I remember vaguely, there was a Debian OpenSSH Vulnerability which affected the seeding of the random number generator. IIRC, the entropy for the key came from two sources:
1) using uninitialized memory
2) using the Process ID (PID)
This bug was caused by commenting out (1), leaving the PID as the only source of entropy. Consequently, the space of possible keys was only 2^16.
Is openssh really using only these two sources of entropy? No /dev/random
?