RSA vs ECDSA keys, which is better

Megan_Wilson

When using SSH keys to login, which is better? RSA, DSA or ECDSA and why is it better.

Alan_Rowell

The biggest differentiator between ECC and RSA is key size compared to cryptographic strength.

The small key sizes make ECC very appealing for devices with limited storage or processing power, which are becoming increasingly common in the IoT. In terms of more traditional web server use cases, the smaller key sizes can offer speedier SSL handshakes (which can translate to faster page load times) and stronger security.

https://www.globalsign.com/en/blog/elliptic-curve-cryptography

So basically, improved security but shorter keys, which saves on computation power and battery. ECDSA or ECC is the favorable choice.

Magnus_Lind

RSA for compatibility, ECDSA for security and speed. Tho even Windows Vista and forward, Internet Explorer 7 and higher, all versions of Chrome, Firefox 4, Android 3 and higher supports ECDSA. There's really no reason not to use ECDSA today.

DSA is an old standard, similar to RSA in security but approved for government applications with slighly higher security requirements than RSA. Some more information below:

Digital Signature Algorithm, or DSA, uses a different algorithm for signing and encryption to RSA, yet provides the same level of security. It was proposed in 1991 by the National Institute of Standards and Technology (NIST) and adopted by the Federal Information Processing Standard (FIPS) in 1993. Since then it has gone under four revisions.

A DSA certificate makes it easier to keep up with government standards as it's endorsed by federal agencies - including the impending move to 2048-bit key lengths. You can even run RSA and DSA simultaneously to enhance your security further. Apache servers, for example, can run RSA and DSA certificates simultaneously on just one web server. This will benefit businesses seeking to maximise their ecosystem reach for their business correspondence.

Source: https://www.ssl247.com/kb/ssl-certificates/generalinformation/what-is-rsa-dsa-ecc

babar7

RSA is fine, just make sure you use 2048 bit key length instead of 1024 because the latter is considered insecure by now. Telnet works too, and it's available on most Windows PC's.

Kauko_Laaksonen

babar7 RSA is fine, just make sure you use 2048 bit key length instead of 1024 because the latter is considered insecure by now. Telnet works too, and it's available on most Windows PC's.

Don't use telnet over internet, that's like asking hackers to steal or tamper with your data. 🤦‍♂️

Marco_Weiss

babar7 RSA is fine, just make sure you use 2048 bit key length instead of 1024 because the latter is considered insecure by now. Telnet works too, and it's available on most Windows PC's.

Actually, you need at least 4096bit keys for RSA by now. 2048bit keys can soon be considered as breached, if it isn't already. 4096bit keys still takes a lot of resources to compute which makes RSA keys a bad choice overall.

babar7

Kauko_Laaksonen Don't use telnet over internet, that's like asking hackers to steal or tamper with your data.

I use VPN so I'm safe anyway. Thanks for caring

George_Hegland

babar7 Well, assuming you can trust your provider at lest you may get a somewhat decent encrypted channel out from your public and open home network. Tho your traffic will still be unencrypted within the cloud, others could listen on your connection.

Samuel_Oldfield

George_Hegland I hear VPC is in beta now, soon you'll get your own private networks, not shared with anyone else. Many providers are adding this feature, some has already added it.

George_Hegland

Samuel_Oldfield Got it working via API. Tho I still prefer managing my own firewall policies.