Most users would simply type
ssh-keygen and accept what they're given by default.
Yes. To do a security for people, it needs to be simple. Therefore the default option should be safe, compatible and fast. You can provide alternatives, but default should be "good enough" for these who don't care. Therefore RSA (2048) in the old PEM format is the default at the moment.
-o for the OpenSSH key format rather than the older PEM format (OpenSSH 6.5 introduced this feature almost 3 years ago on 2014-01-30)
Three years is nothing. A lot of containers managed to evolve during these years, but SSH is here more than 20 years and still needs to deal with older clients. The new OpenSSH format is not widely adopted and supported yet.
- How should one calculate how many rounds of KDF to use with
Depends on the use case. Creating your key for your "stuff" repo on Github will be different than creating a keys in your favorite national agency as a certification authority or to access super-secret documents on dedicated server.
As pointed out, this is only for the new format, which is not yet widely used and it increases the time to decrypt key. The default number of rounds is
16 (would be nice to see it documented somewhere). More in the Cryptography question.
-T be used to test the candidate primes for safety? What
-a value to use with this?
No. It is used for generating primes (
/etc/ssh/moduli) for DH key exchange. It is not used in any way for generating SSH keys. How to generate and test the
moduli file is explained in separate chapter
MODULI GENERATION of manual page for
- For the different key types, what are the recommended minimum
-b bit sizes?
This is not SSH specific, but generally key sizes are recommended by NIST in this document, page 12 (per 2015):
RSA (2048 bits)
ECDSA (Curve P-256)
The Ed25519 does have fixed size so the
-b parameter is ignored.