SSH加密算法ED25519优于RSA

2024-01-04
#Unix

在密钥加密算法中, Ed25519 是使用 SHA-512(SHA-2)和 Curve25519 的 EdDSA 签名方案 1

从 2020 年开始,在 Secure Shell (SSH) 协议中, Ed25519 已经成为标准 2,有如下优势 3

  • 快速单签名验证 Fast single-signature verification
  • 更快的批量验证 Even faster batch verification
  • 非常快速的签名 Very fast signing
  • 快速密钥生成 Fast key generation
  • 高安全级别 High security level
  • 万无一失的会话密钥 Foolproof session keys
  • 碰撞复原力 Collision resilience
  • 没有秘密数组索引 No secret array indices
  • 没有秘密分支条件 No secret branch conditions
  • 小签名 Small signatures
  • 小钥匙 Small keys

GitHub 发表更新密钥的声明4

Note: GitHub improved security by dropping older, insecure key types on March 15, 2022.

As of that date, DSA keys (ssh-dss) are no longer supported. You cannot add new DSA keys to your personal account on GitHub.com.

RSA keys (ssh-rsa) with a valid_after before November 2, 2021 may continue to use any signature algorithm.

RSA keys generated after that date must use a SHA-2 signature algorithm. Some older clients may need to be upgraded in order to use SHA-2 signatures.

本地终端,生成 ed25519 密钥:

ssh-keygen -t ed25519 -C "your_email@example.com"

注意⚠️: ‘your_email@example.com’ 可以是邮箱5 或 服务器登录命令6

延伸阅读

  1. EdDSA - Wikipedia
  2. RFC 8709 - Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol
  3. Ed25519: high-speed high-security signatures
  4. Adding a new SSH key to your GitHub account - GitHub Docs
  5. macOS设置GitHub公钥命令行登录
  6. macOS终端SSH公钥登陆服务器