blog.bythewood.me-rust

 1---
 2title: Generating a ED25519 SSH key with OpenSSH
 3slug: generating-a-ed25519-ssh-key-with-openssh
 4date: 2022-05-07
 5publish_date: 2022-05-07
 6tags: security
 7description: OpenSSH has deprecated RSA keys. Time to swap to ED25519 with a few quick commands as well as an easy way to ease into the swap with host key configurations.
 8cover_image: openssh-logo.webp
 9---
10
11With the release of OpenSSH 8.7 the `ssh-rsa` signature scheme has been deprecated.
12
13> OpenSSH will disable the ssh-rsa signature scheme by default in the next release. In the SSH protocol, the "ssh-rsa" signature scheme uses the SHA-1 hash algorithm in conjunction with the RSA public key algorithm. It is now possible[1] to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K.
14
15You can read more about that on their [release notes](https://www.openssh.com/txt/release-8.7).
16
17That means we should probably generate new keys as soon as possible using the suggested ED25519. To do that is as simple as running:
18
19```shell
20cd ~/.ssh
21ssh-keygen -t ed25519 -C "[email protected]"
22```
23
24While you get all your services updated with your new key you can still use your old key temporarily by adding an extra line to your `~/.ssh/config` file.
25
26```shell
27echo "PubkeyAcceptedKeyTypes +ssh-rsa" >> .ssh/config
28```
29
30If you have a lot of services that share SSH keys consider swapping out your most important ones first and then adding some extra lines to your `~/.ssh/config` file to use different keys for different hosts.
31
32```shell
33Host example.com
34    HostName example.com
35    User myuser
36    IdentityFile ~/.ssh/id_rsa
37Host example2.com
38    HostName example2.com
39    User myuser
40    IdentityFile ~/.ssh/id_ed25519
41```
42
43To my understanding, if you follow security best practices and don't have port 22 open to the entire web on your servers then this deprecation isn't of immediate concern.