3

I noticed that when showing the fingerprint of different key types, there is one difference in the format. for some reason ED25519 has the hash bits (I guess?) - 256, whereas the other key types have the key length in bits instead. As you can see in the examples I pasted below.

Any special reason? I couldn't find a specific reason documented, and since i'm implementing something with ssh key fingerprints and I wonder if I should follow ssh-keygen way which is strange.

 ssh-keygen -l -f test_key_ed25519
 256 SHA256:YxdmTBeIiFs0XqhabPHLf9qApHqrwJpT+f7N/KiNFcs <comment> (ED25519)

 ssh-keygen -l -f test_key_rsa.pub        
 2048 SHA256:IbwM2e+II6UGAalZAsyqqPHHIzj+rNUAsu/u7gL65ac Roy.BenYosef@NG-ROY-B (RSA)

 ssh-keygen -t ecdsa -b 256 -f test_key_ecdsa
 ssh-keygen -l -f test_key_ecdsa.pub         
 256 SHA256:psFwJHQSS5j3QhWzRac8INZGm9tcSymNj2dTSmG8Moc Roy.BenYosef@NG-ROY-B (ECDSA)

 ssh-keygen -t ecdsa -b 384 -f test_key_ecdsa-384
 ssh-keygen -l -f test_key_ecdsa-384.pub 
 384 SHA256:pIWLmWuefaFMjeQAAU4DYW+e5sr/xdMvp7BpUr00Ngs Roy.BenYosef@NG-ROY-B (ECDSA)
Improve this question
2
  • 2
    From Wikipedia about e´Ed25519: "Public keys are 256 bits long". So there is no difference here.
    – Steffen Ullrich
    Commented Jun 19, 2022 at 14:47
  • 1
    I think you're confusing the number 25519 for a bit length. I am not sure what it means precisely, but it identifies a curve rather than a number of bits, and that is why it is in the name.
    – Luc
    Commented Jun 19, 2022 at 19:31

1 Answer 1

Reset to default
6

ssh-keygen -l shows you more than just the fingerprint. The fingerprint is the second piece starting with SHA256:. It also shows you the key size in bits, which is the first part; the comment, which is the third part; and the key type, which is the final part.

Ed25519 keys are all 256 bits long, so this number of bits makes sense. Similarly, your ECDSA keys either use 256- or 384-bit curves and they are listed accordingly. In your case, you have a 2048-bit RSA key, and that number of bits is also printed.

In general, if you're just printing the fingerprint, you just need the second part. This is the right format for all modern SSH clients, and the only difference would be if you're using SSHFP records, where the hash is in hex instead. Some very old SSH clients use MD5 instead, but we no longer consider MD5 fit to be used for any purpose, so there's no reason to implement that.

Improve this answer
1
  • 1
    I was under the impression that a ed25519 key length is 408 bits. after reading your answer, I investigated some more and learned that, as you said, it is in fact 256. thank you!
    – Roy Ca
    Commented Jun 19, 2022 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .