/compare/ssh-protocol/ed25519-vs-rsa-ssh-keys
SSH keys: Ed25519 vs RSA, which one to use?
- tool
- SSH protocol
- compares
- Ed25519 vs RSA
Use Ed25519 for new SSH keys: ssh-keygen -t ed25519. It has a fixed, strong security level, short keys and signatures, and fast signing and verification. Use RSA (at least 3072 bits) only for systems that do not support Ed25519, such as old network devices or SSH servers older than OpenSSH 6.5. Both are secure when used correctly; Ed25519 has fewer ways to get it wrong.
Generate both and compare
ssh-keygen -q -t ed25519 -N "" -C "me@laptop" -f id_ed25519
ssh-keygen -q -t rsa -b 3072 -N "" -C "me@laptop" -f id_rsa
for k in id_ed25519 id_rsa; do
printf '%-11s bits+type: %-14s public key: %4s bytes private key: %4s bytes\n' "$k" \
"$(ssh-keygen -l -f $k.pub | awk '{print $1, $NF}')" "$(wc -c < $k.pub)" "$(wc -c < $k)"
done
cut -c1-32 id_ed25519.pubOutput
id_ed25519 bits+type: 256 (ED25519) public key: 91 bytes private key: 399 bytes id_rsa bits+type: 3072 (RSA) public key: 563 bytes private key: 2590 bytes ssh-ed25519 AAAAC3NzaC1lZDI1NTE5
The Ed25519 public key fits on one short line (an ssh-ed25519 prefix, 32 bytes of key material in base64, the comment). A 3072-bit RSA public key is several times longer, which matters for authorized_keys files, hardware tokens and copy-paste.
Side by side
| Ed25519 | RSA | |
|---|---|---|
| Algorithm | EdDSA on Curve25519 (RFC 8709 for SSH) | RSA with rsa-sha2-256/512 signatures (RFC 8332) |
| Security level | About 128 bits, fixed | 3072 bits gives about 128 bits; 2048 is the minimum still accepted |
| Key size option | None (-b is ignored) | -b 3072 or -b 4096 |
| Signature size | 64 bytes | Same as the modulus (384 bytes for 3072-bit keys) |
| Speed | Fast signing and verification | Slow key generation and signing, fast verification |
| Randomness at signing time | Not needed (deterministic signatures) | Needed for key generation |
| Support | OpenSSH 6.5+ (2014), most current servers, GitHub, GitLab | Everywhere, including very old systems |
The ssh-rsa deprecation is about SHA-1, not RSA keys
OpenSSH 8.8 disabled the ssh-rsa signature algorithm, which hashes with SHA-1. RSA keys still work with the rsa-sha2-256 and rsa-sha2-512 signature algorithms, which both sides negotiate automatically when they are new enough. Errors like no mutual signature algorithm appear when a new client meets a server that only knows ssh-rsa; the durable fix is upgrading the server or switching to an Ed25519 key, not re-enabling SHA-1.