Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 75 down vote favorite
22

SSH supports two signature algorithms for key pairs: RSA and DSA. Which is preferred, if any? For RSA, what is the minimum acceptable key length?

share|improve this question

6 Answers

up vote 55 down vote accepted

RSA is generally preferred (now that the patent issue is over with) because it can go up to 4096 bits, where DSA has to be exactly 1024 bits (in the opinion of ssh-keygen). 2048 bits is ssh-keygen's default length for RSA keys, and I don't see any particular reason to use shorter ones. (The minimum possible is 768 bits; whether that's "acceptable" is situational, I suppose.)

share|improve this answer
   
I have often wondered why people feel the need to secure their ssh connections with 2048 bit key, when your bank, which you presumably trust, is very unlikely to go over 256 bits, and is more likely to stick with 128 bits. I'm certainly not saying there's anything wrong with using a large key, I'm just…sayin'. – msanford Jul 13 '09 at 19:57
22  
The bank SSL connection is a different kind of cipher being used and more specifically the key used for the main parts of the transaction is generated and used solely for that transaction and then discarded. – Ophidian Jul 13 '09 at 20:20
The reason is actually to do with scaling. encryption isn't cheap and the higher your keystrength is the less SSL connections you can serve. If you have a retail bank with every consumer trying to use SSL then you are going to have to pick a compatible key suite but one that also matches your hardware. – Spence Aug 5 '09 at 23:22
13  
msanford: Like Ophidian said they are different kinds of encryptions. 256bit RSA keys would be completely useless for pretty much any purpose. The symmetric keys are in the range 128-512bit, while assymetric start at 768bit, and are secure at about 1500-2000bit and up. 768bit public keys can and have been broken. 128bit symmetric cannot (in itself) practically be broken. – Thomas Aug 6 '09 at 11:06
2  
@xenoterracide, ssh uses the openssl libraries. When SSH first starts it uses RSA/DSA keys to do host verification and to setup the symmetrical keys for the session. This is the same procedure that SSL servers and client follow, so you will find that we people talk about SSH, they will often refer to allow the research and documentation done for SSL – Walter Mar 17 '10 at 15:05
show 3 more comments
up vote 28 down vote

The man page for ssh-keygen says:

-b bits

   Specifies the number of bits in the key to create.  For RSA keys,
   the minimum size is 768 bits and the default is 2048 bits.  Gen-
   erally, 2048 bits is considered sufficient.  DSA keys must be
   exactly 1024 bits as specified by FIPS 186-2.

Supposedly, according to Bruce Schneier, "both DSA and RSA with the same length keys are just about identical in difficulty to crack." I haven't been able to substantiate that exact wording, but did find a couple references that imply that's what he believes (or believed at one point):

  1. http://www.schneier.com/crypto-gram-9911.html
  2. http://www.securityfocus.com/columnists/324

Seeing as how the only legal value for DSA keys is 1024 bits, I suppose it comes down to whether a 1024 bit key is sufficient. It looks like the answer is quite possibly not.

share|improve this answer
2  
+1 Great answer! – msanford Jul 13 '09 at 19:55
+1 Useful info. – Coops Jul 13 '09 at 21:53
5  
You can actually generate longer (2048 bits) DSA key with openssl, and SSH will happily make use of them. I had to do that a while back because one bank required it, and I have no f'ing clue why 1. they used that (but they had no clue whatsoever about anything anyway) and 2. why ssh-keygen won't let you force it to use an arbitrary length. – niXar Aug 5 '09 at 23:31
Some SMB Cisco switches use DSA with just 512 bits. – joechip Jul 12 '11 at 21:46
up vote 4 down vote

It's not about symmetric or asymetric encryption. It's about particular algorithms (RSA and DSA) requiring higher bit count to achieve acceptable security level. For example, ECC is also an asymmetric encryption, but it provides good security at much lower bit counts than RSA or DSA.

share|improve this answer
up vote 3 down vote

If you have a recent implementation of SSH, you may also consider ECDSA !

share|improve this answer
up vote 2 down vote

256 bit certificates that banks use for SSL connections are symmetric cyphers such as 3DES or AES, hence the lower bit count. When you see 1024 and 2048 (and even 4096) these are asymmetric ciphers.

share|improve this answer
up vote 0 down vote

DSA keys have much shorter signaures than RSA keys (for the same "level of security"), so one reason for using DSA would be in constrained environments.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.