Skip to main content
The 2024 Developer Survey results are live! See the results
42 votes

Should I be using ECDSA keys instead of RSA for SSH?

For "bits of security", see something like this comparison. For why ECC over Prime Field gives you security equivalent to half the bit size, while RSA and FFDHE give much less security per-bit, it's ...
Z.T.'s user avatar
  • 8,544
34 votes
Accepted

Should I be using ECDSA keys instead of RSA for SSH?

ECC keys can be much shorter than RSA keys, and still provide the same amount of security, in terms of the amount of brute force that an attacker would need to crack these keys. For example, a 224-...
mti2935's user avatar
  • 23.7k
15 votes

Recommended asymmetric algorithms for JWT?

The short answer is to use RS256, to be understood as SHA 256 with RSA 2048 bits keys. See RFC 7518 JSON Web Algorithms (JWA) for all supported algorithms. On signing algorithms There are two major ...
user5994461's user avatar
  • 1,296
10 votes

Should I be using ECDSA keys instead of RSA for SSH?

To be complementary to other answers, just let me share a nice table taken from NIST SP 800-57: Basically, what you can see here is that you would need RSA 3072 bit vs ECDSA 256-383 bit to achieve ...
Alexander Fadeev's user avatar
9 votes
Accepted

GnuPG: How to create ECDSA signature?

okay, seems one has to add the --expert flag: $ gpg --full-generate-key --expert gpg (GnuPG) 2.2.25-unknown; Copyright (C) 2020 Free Software ...
matthias_buehlmann's user avatar
7 votes

Should I be using ECDSA keys instead of RSA for SSH?

There are pros and cons. We rate the security strength of algorithms by asking "using the best known attack how long would it take to break this". There is a known attack on RSA and ...
Peter Green's user avatar
  • 5,300
6 votes
Accepted

Recommended asymmetric algorithms for JWT?

RFC7518 lists the algorithms and whether they are required, recommended or optional for a JWT library. This can help you choose an algorithm that has implementations in other libraries, for ...
Sjoerd's user avatar
  • 31.8k
6 votes
Accepted

Difference in ECDSA private key format

(I feel sure I've answered essentially this question before, but I can't find a dupe.) OpenSSL partly created, and supports, two (or four depending how you count) types of PEM formats for private keys....
dave_thompson_085's user avatar
4 votes
Accepted

How do I turn an 88 byte ECDSA public key into a 65 byte uncompressed or 33 byte compressed key for use with bitcoin

When you say, 88 byte ECDSA public key, I think what you are actually referring to is a 65-byte uncompressed public key, which has been base64-encoded. Base64 encoding requires 4 characters for every ...
mti2935's user avatar
  • 23.7k
4 votes

Convert ECDSA keys (PEM, OpenSSH)

Which key(s) are you trying to use with that library -- private or public, which that library calls Signing and Verifying -- or both? ssh-keygen -t ecdsa -b $n -m pem (in OpenSSH 7.8 up) with empty ...
dave_thompson_085's user avatar
4 votes
Accepted

Mix and match RSA and ECDSA in TLS

YES -- there is no necessary connection between the types of keys and certs used by TLS server and client for authentication (nor between the Certificate Authorities and trust decisions). For TLS ...
dave_thompson_085's user avatar
4 votes
Accepted

Is it possible to fake ECDSA signatures?

The comments in that reddit thread actually explain it fairly well. In a way you could say that it is possible to 'fake ECDSA signatures', but it does not tell the whole story. You have three ...
ElectronicToothpick's user avatar
3 votes
Accepted

Premeditated substitution of ECDSA-signed message by the signer

Is there something I miss? A documented case where what the paper describes has lead to disaster or dispute? A common mitigation? There are certainly some attacks which have used very similar ...
Dennis Jackson's user avatar
2 votes

why does ssh prompt with the ECDSA key instead of RSA

ssh-keygen -l seems to default to RSA and it knows the default path. ssh-keygen -l defaults to use a RSA key within the users home directory, i.e. ~/.ssh/id_rsa. Keys in the home directory are used ...
Steffen Ullrich's user avatar
2 votes

Difference in ECDSA private key format

The encoding of the OpenSSH keys is just base64 so once they do not have passphrase, you can analyze the content. The first one: $ base64 -d | hexdump -C ...
Jakuje's user avatar
  • 5,879
2 votes
Accepted

How to store ECDSA public key securely in Android

You really do not need to worry about that, that is the reason its called public key. You should instead seek to secure your private key, because its the key you actually use to sign the data and it ...
Emmanuel Edwards's user avatar
2 votes
Accepted

Verify signature without digest

EVP_Digest{Sign,Verify}* always hash the data before signing/verifying; that's their whole purpose. Less obviously, the older (before 1.0.0 in 2010) EVP_{Sign,Verify}* also do this. Trying to get them ...
dave_thompson_085's user avatar
2 votes
Accepted

How sensitive is the primary key stub of an ed25519 security key (~/.ssh/id_ed25519_sk)?

From the "FIDO/U2F Support" section in OpenSSH 8.2 Release Notes The private key file should be useless to an attacker who does not have access to the physical token.
Lu Wang's user avatar
  • 136
2 votes
Accepted

wrong curve error during TLS handshake with vsftpd

The P-384 curve is a red herring. Certificate verification is almost certainly failing in your case because you've got an RSA certificate installed on the vsftpd server, but you're telling your client ...
Polynomial's user avatar
  • 135k
1 vote
Accepted

Why does the Public Key Info field in an X509 certificate for EC indicate the algorithm

It doesn't. A certificate endorsing a key intended to be used for ECDH can be identified as id-ecdh or id-ecPublicKey, but a certificate endorsing a key for ECDSA can only be identified as id-...
bartonjs's user avatar
  • 1,878
1 vote

SSH Handshake on Cisco IOS XE

ssh-rsa can mean multiple things in SSH2. ssh-rsa as public key algorithm The public key algorithm "ssh-rsa" is deprecated, which is used as part of host key verification and for user ...
Manfred Kaiser's user avatar
1 vote

Premeditated substitution of ECDSA-signed message by the signer

The point of the cited paper is that security analysis of a signature algorithm must look beyond the signature algorithm itself. Here, the authors demonstrate that collusion between key generation and ...
amon's user avatar
  • 1,346
1 vote
Accepted

Which KEK can wrap AES, RSA and ECDSA keys securely?

Keys are not so special that they need special ways of encrypting them. Any key that's secure enough to encrypt data for your needs is secure enough if that data happens to be, or include, another key....
Gilles 'SO- stop being evil''s user avatar
1 vote

Recommended asymmetric algorithms for JWT?

RSA is often the algorithm of choice, as it is now rather old and survived going through a lot of scrutiny. You can't go wrong chosing it. The 256 variant is good enough IMO as SHA256 is nowhere near ...
Peter Harmann's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible