Generating Secure SSH Keys: Ed25519 vs RSA

The Mechanics of SSH Key Authentication

SSH keys provide a more secure and convenient alternative to password authentication. They operate on public-key cryptography: you generate a pair of mathematically linked keys. The Private Key remains secretly on your machine, while the Public Key is uploaded to the server's authorized_keys file. When you connect, the server uses the public key to issue a cryptographic challenge that only your private key can solve.

Choosing an Algorithm

When generating keys, you must choose an algorithm. The landscape has evolved significantly:

Algorithm	Key Size	Security Level	Performance	Compatibility
RSA	2048 to 4096 bits	High (if >= 2048)	Slower generation/signing	Universal (legacy systems)
ECDSA	256, 384, 521 bits	High	Fast	High (modern systems)
Ed25519	256 bits (fixed)	Very High	Extremely Fast	Good (OpenSSH 6.5+)

Ed25519 is the modern recommendation. It offers excellent security, fast performance, and produces small, easily manageable public keys.

Generating Keys with ssh-keygen

To generate a modern Ed25519 keypair:

ssh-keygen -t ed25519 -C "your_email@example.com"

If you must use RSA for legacy server compatibility, always use at least a 4096-bit key:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Understanding Key Fingerprints

A fingerprint is a shorter, human-readable hash of the public key (often formatted in SHA256 or MD5). When you connect to a new server, SSH displays the server's fingerprint. Verifying this fingerprint prevents Man-in-the-Middle (MitM) attacks.

# View a local key fingerprint
ssh-keygen -lf ~/.ssh/id_ed25519.pub

Managing Multiple Keys

If you have different keys for GitHub, work, and personal servers, configuring ~/.ssh/config simplifies connections:

Host github.com
    IdentityFile ~/.ssh/id_ed25519_github
    User git

Host work-server
    HostName 203.0.113.10
    IdentityFile ~/.ssh/id_rsa_work
    User deploy

The Role of ssh-agent

To avoid typing your passphrase every time, use ssh-agent. It holds your decrypted private keys in memory for the duration of your session.

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Security Best Practices

• Passphrase Protection: Always encrypt your private key with a strong passphrase.
• Key Rotation: Periodically generate new keys and remove old ones from authorized_keys.
• Minimum Key Sizes: Never use RSA keys smaller than 2048 bits; 1024-bit RSA is considered broken.
• Deprecated Algorithms: DSA (ssh-dss) is completely deprecated and disabled in modern OpenSSH versions.

Generate your keypairs securely in-browser using our SSH Key Generator.

To learn more about secure credential management, check out our Password Hashing Guide.