These are two questions so closely related that I am asking them together - hope that's OK.

When I

  1. create new SSH keys (e.g. with ssh-keygen -t rsa -b 4096 or ... 8192); and when I
  2. create new prime numbers for /etc/ssh/moduli (e.g. with ssh-keygen -G /tmp/moduli-2048.candidates -b 2048; ssh-keygen -a 800 -T /etc/ssh/moduli-2048 -f /tmp/moduli-2048.candidates

I wonder what are the safest but practical options in key size -b xxxx and -a yyyy rounds on a standard PC, given that more bits usually mean better security but are much more difficult to test for security-relevant properties like primality?

Of course, in case 1 it may be that you do not need primes - but still "good" keys, and the question is still how to achieve optimal keys, preferably in a few hours PC CPU time (a few days for moduli is OK I guess).

(I wondered whether a question like this is something that could be asked here but concluded that, probably, yes since what I need is not a how-to but advice by specialists on technologies too complex for me to comprehend.)

  • 2
    See also Secure Secure Shell. – Sjoerd Jan 22 '17 at 15:59
  • 2
  • Thanks a lot for the reading list, I will look at it. However, I do not really think the Server Fault article really addresses the problem of weak primes, does it? The question about server vs. client is also not answered. Furthermore, my question does apply to servers, as well. – Ned64 Jan 22 '17 at 20:08
  • Is there no-one who knows about the most secure bit sizes today? – Ned64 Feb 27 '17 at 9:44
  • Old bump, but as of 2018 standards, 2048-bit DH and RSA seems to be the choice of most security experts. I myself have opted for a 4096-bits or higher for my own purposes and paranoia. The true answer can only be a recommendation, and what not to use. – Dooley_labs Feb 14 '19 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.