ECDSA key generation

shyko · 01-27-2011, 07:24 AM

I'm not a master on ssh keys but it seems that with the last openssh update on -current:

Quote:

Thu Jan 27 01:53:26 UTC 2011
n/openssh-5.7p1-x86_64-1.txz: Upgraded.

The rc.sshd perhaps should include a command to generate a ECDSA key:

Code:

if [ ! -f /etc/ssh/ssh_host_ecdsa_key ]; then
    /usr/bin/ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N ''
fi

ponce · 01-28-2011, 01:40 AM

if you do that, then ECDSA is used as the preferred key agreement algorithm when both the client and server support it.

I am personally just considering that:
- RSA served slackware, and more widely openssh, users by default for many years;
- looks like openbsd developers (many work on openssh too) were still cautious about the adoption of ECDSA as default four months ago;
- you can have situations like this;
- seeing it from the end user side, the decision of not generating the ECDSA keys, should have as a consequence just a simple warning when starting the daemon.

so, I think, it should be perfectly fine to ponder about it a little