These are two questions so closely related that I am asking them together - hope that's OK.
- create new SSH keys (e.g. with
ssh-keygen -t rsa -b 4096or
... 8192); and when I
- create new prime numbers for
ssh-keygen -G /tmp/moduli-2048.candidates -b 2048; ssh-keygen -a 800 -T /etc/ssh/moduli-2048 -f /tmp/moduli-2048.candidates
I wonder what are the safest but practical options in key size
-b xxxx and
-a yyyy rounds on a standard PC, given that more bits usually mean better security but are much more difficult to test for security-relevant properties like primality?
Of course, in case 1 it may be that you do not need primes - but still "good" keys, and the question is still how to achieve optimal keys, preferably in a few hours PC CPU time (a few days for moduli is OK I guess).
(I wondered whether a question like this is something that could be asked here but concluded that, probably, yes since what I need is not a how-to but advice by specialists on technologies too complex for me to comprehend.)