SSH and GPG: Best Key Generation Options in 2025?
from some_boring_username@lemm.ee to linux@lemmy.ml on 13 Jan 05:34
https://lemm.ee/post/52476929

Hi everybody,

I am a bit out of the loop as far as cryptography algorithms and recommended key sizes are concerned. I have been using the same ssh and gpg keys for a long time.

However, I need to generate a few new keys (both ssh and gpg) that should meet high security standards (private use, but paranoid) and was wondering what options are the most common and recommended ones you are using today?

Thanks a lot to everybody in advance!

#linux

threaded - newest

harsh3466@lemmy.ml on 13 Jan 05:51 next collapse

Short Answer is ed25519, which is the new default key encryption in open SSH. Here’s an explainer that helped me

some_boring_username@lemm.ee on 13 Jan 06:26 next collapse

Thanks! Cool video, I like her style. (Will look into the specifics of ed25519 out of interest when I have time… So, most probably not and I’ll just use it ;-D)

some_boring_username@lemm.ee on 13 Jan 14:06 collapse

For GPG it is the same?

mlaga97@lemmy.mlaga97.space on 13 Jan 15:14 collapse

RSA4096 has a bit of an edge over ed25519 both in effective key size as well as support by things like YubiKeys and other HSMs that is beneficial for GPG but not really helpful for SSH.

some_boring_username@lemm.ee on 13 Jan 16:02 collapse

Ah, that’s a good point, thanks!

JubilantJaguar@lemmy.world on 13 Jan 14:57 next collapse

The correct answer to this question should be ''Whatever is the current default".

If we have to ask and answer such questions as this (I’m unconvinced), then something is really wrong.

mlaga97@lemmy.mlaga97.space on 13 Jan 15:10 next collapse

SSH generally best to use ed25519, for GPG RSA4096 is better supported by HSMs and slightly more secure for longer-lived keys like root keys.

tla@lemmy.world on 13 Jan 21:09 collapse

Others have provided the answer but if you want to explore system wide crypto policies check out update-crypto-policies

deadcatbounce@reddthat.com on 13 Jan 22:21 collapse

Don’t understand. Check it out where?

tla@lemmy.world on 16 Jan 22:23 collapse

From a terminal window: man update-crypto-policies or just search for an explanation in your browser.

deadcatbounce@reddthat.com on 18 Jan 05:46 collapse

Ah. I didn’t imply the ‘man’ in there.

Thank-you.