I'm creating a python script that generates SSH keys for my raspberry pi SD card installation before I boot the SD for the first time, so I can get the fingerprints without having to boot it for the first time for it to generate the keys

/etc/ssh $ ls
moduli                ssh_host_ecdsa_key        ssh_host_key.pub
ssh_config            ssh_host_ecdsa_key.pub    ssh_host_rsa_key
sshd_config           ssh_host_ed25519_key      ssh_host_rsa_key.pub
ssh_host_dsa_key      ssh_host_ed25519_key.pub
ssh_host_dsa_key.pub  ssh_host_key

I'm using paramiko to generate the keys. I've generated DSA, RSA and ECDSA using:


However, Paramiko won't generate ssh_host_ed25519_key. However, the library that paramiko uses can generate it: https://cryptography.io/en/latest/hazmat/primitives/asymmetric/x25519/

I've also noted that the signature for ecdsa.generate is:

 classmethod generate(curve=<cryptography.hazmat.primitives.asymmetric.ec.SECP256R1 object>, progress_func=None, bits=None)

Is <cryptography.hazmat.primitives.asymmetric.ec.SECP256R1 object> a class that can generate the ssh_host_ed25519_key?

I'm asking about this because I didn't want to use the cryptography.hazmat directly because of this advice:


This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing because this module is full of land mines, dragons, and dinosaurs with laser guns.

1 Answer 1


cryptography.hazmat.primitives.asymmetric.ec.SECP256R1 does ECDSA on SECP256R1 (RFC 5480). ssh_host_ed25519_key is based on Bernsteins's Curve25519. They are different curves, so the keys are incompatible. You can possibly try inserting the alternate curve to the generate function, but you should also keep in mind that you don't have to have every key type -- it just gives you more flexibility.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .