Differences between RSA, DSA, ECDSA, EdDSA, and Ed25519

🛠 Tools and Programming
1

This article is transcoded by SimpRead, original address www.cnblogs.com

Those who have used ssh know that there are many types of ssh keys, such as dsa, rsa, ecdsa, ed25519, etc. With so many types, how should we choose?

Explanation

  1. RSA, DSA, ECDSA, EdDSA, and Ed25519 are all used for digital signatures, but only RSA can also be used for encryption.

    • RSA (Rivest–Shamir–Adleman) is one of the earliest public key cryptosystems and is widely used for secure data transmission. Its security depends on integer factorization, so it never requires a secure RNG (random number generator). Compared to DSA, RSA’s signature verification is faster, but key generation is slower.

    • DSA (Digital Signature Algorithm) is the Federal Information Processing Standard for digital signatures. Its security depends on the discrete logarithm problem. Compared to RSA, DSA’s signature generation is faster, but verification is slower. Using a faulty random number generator may compromise security.

    • ECDSA (Elliptic Curve Digital Signature Algorithm) is the elliptic curve implementation of DSA. Elliptic curve cryptography can provide comparable security to RSA with smaller keys. It also shares DSA’s vulnerability to poor RNG.

    • EdDSA (Edwards-curve Digital Signature Algorithm) is a digital signature scheme using a Schnorr signature variant based on twisted Edwards curves. Signature creation in EdDSA is deterministic, and its security is based on the hardness of certain discrete logarithm problems, making it more secure than DSA and ECDSA, which require high-quality randomness for each signature.

    • Ed25519 is an EdDSA signature scheme but uses SHA-512/256 and Curve25519; it is a secure elliptic curve offering better security than DSA, ECDSA, and EdDSA, alongside better performance (subject to human attention).

  2. Other notes

    • RSA keys are the most widely used and thus appear to have the best support.

    • ECDSA (introduced in OpenSSH v5.7) is computationally lighter than DSA, but the difference is not noticeable unless you have a very low-power machine.

    • Starting from OpenSSH 7.0, SSH no longer supports DSA keys (ssh-dss) by default. According to SSH standards (RFC 4251 and later), DSA keys can still be used anywhere.

    • Ed25519 was introduced in OpenSSH 6.5.

    • Related article

      OpenSSH supports several signing algorithms (for authentication keys) which can be divided in two groups depending on the mathematical properties they exploit: DSA and RSA, which rely on the practical difficulty of factoring the product of two large prime numbers, ECDSA and Ed25519, which rely on the elliptic curve discrete logarithm problem. (example) Elliptic curve cryptography (ECC) algorithms are a more recent addition to public key cryptosystems. One of their main advantages is their ability to provide the same level of security with smaller keys, which makes for less computationally intensive operations (i.e. faster key creation, encryption and decryption) and reduced storage and transmission requirements. OpenSSH 7.0 deprecated and disabled support for DSA keys due to discovered vulnerabilities, therefore the choice of cryptosystem lies within RSA or one of the two types of ECC. #RSA keys will give you the greatest portability, while #Ed25519 will give you the best security but requires recent versions of client & server[2]. #ECDSA is likely more compatible than Ed25519 (though still less than RSA), but suspicions exist about its security (see below).

Conclusion

  1. There are four types of ssh keys: dsa, rsa, ecdsa, and ed25519.

  2. Based on mathematical properties, these four types can be divided into two categories: dsa/rsa and ecdsa/ed25519, with the latter group having more advanced algorithms.

  3. DSA is no longer used due to security issues.

  4. ECDSA is not recommended due to political and technical reasons.

  5. RSA is currently the most compatible and widely used key type. When generating keys with ssh-keygen, this type is used by default. However, if the specified key size is too small, there are security problems. It is recommended that the key size be 3072 bits or larger.

  6. Ed25519 is currently the most secure and fastest key type for encryption and decryption. Due to its mathematical characteristics, its key length is much shorter than RSA and is therefore recommended as the priority choice. Its only issue is compatibility, i.e., it may not work with older ssh tool versions. However, according to my current tests, no such problems have been found.

Summary

Prefer Ed25519 first, otherwise choose RSA

Ref

SSH是什么？为什么要用？怎么用？