Why Move Away from RSA?
For over a decade, the 2048-bit RSA algorithm was the gold standard for generating SSH keys. However, as computing power increases, 2048-bit RSA is no longer considered completely future-proof, and generating 4096-bit RSA keys creates significantly slower connections. The Ed25519 algorithm (based on elliptic curve cryptography) is the modern standard. Ed25519 keys are significantly more secure than RSA, generate much faster, create drastically smaller public keys, and offer lightning-fast connection speeds.
Step 1: Check Your SSH Version
The Ed25519 algorithm is supported by default in OpenSSH version 6.5 and newer. Because version 6.5 was released in 2014, virtually every modern Linux distribution supports it. You can verify your version by running:
ssh -V
Step 2: Generate the Ed25519 Key Pair
To generate the new key pair, open your terminal and run the ssh-keygen command, explicitly defining the -t (type) as ed25519. It is also best practice to use the -C (comment) flag to label the key with your email address for easy identification later.
ssh-keygen -t ed25519 -C "[email protected]"
Step 3: Secure the Private Key with a Passphrase
The utility will prompt you to choose a save location. Press Enter to accept the default location (~/.ssh/id_ed25519).
Next, you will be prompted to enter a passphrase. Do not skip this step! If a hacker manages to steal your laptop and extract the private key file, a strong passphrase ensures the key remains encrypted and useless to them. Type a strong passphrase and press Enter.
Step 4: Copy the Public Key to the Remote Server
The generation process created two files: id_ed25519 (your highly secret private key) and id_ed25519.pub (your public key). You must push the public key to any remote server you wish to log into.
Use the built-in ssh-copy-id utility to automatically install the public key onto the remote machine:
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]
You will be prompted to enter the remote user’s password one final time to authorize the transfer.
Step 5: Test the Secure Connection
You can now test your new, highly secure elliptic curve connection by attempting to SSH into the remote server:
Instead of the remote server’s password, your local SSH agent will prompt you for the passphrase you created in Step 3 to unlock your private key. You have now successfully upgraded your infrastructure security to modern standards.