How to Securely Generate and Use Ed25519 SSH Keys for Remote Server Authentication

The Shift Away from RSA

For nearly two decades, RSA (Rivest-Shamir-Adleman) keys were the undisputed standard for SSH authentication. When server administrators created key pairs, they blindly typed ssh-keygen -t rsa -b 4096. However, the cryptography landscape has evolved. While a 4096-bit RSA key is still considered mathematically secure, it is incredibly slow to generate, slow to authenticate, and produces massively long, unwieldy key files.

The modern standard for SSH authentication is Ed25519. Introduced to OpenSSH in 2014, Ed25519 is an elliptic curve signature scheme that offers several massive advantages over RSA:

• Better Security: It is highly resistant to side-channel attacks and collision attacks.
• Faster Performance: Both key generation and signature verification are significantly faster than RSA, noticeably speeding up your SSH login times.
• Smaller Keys: The keys are fixed at 256 bits (which provides security equivalent to a 3072-bit RSA key). This results in a public key that fits on a single line, making it much easier to copy and paste into authorized_keys files or cloud provider dashboards.

Step-by-Step: Generating an Ed25519 Key Pair

You generate the keys on your local machine (the laptop or workstation you are using to connect), not on the remote server.

Step 1: Open Your Terminal

Open your local terminal (or PowerShell, if you are on Windows 10/11) and type the following command:

ssh-keygen -t ed25519 -C "[email protected]"

The -C flag is optional; it adds a comment (usually your email) to the end of the public key file to help you identify it later.

Step 2: Define the Save Location

The system will prompt you to save the key:

Enter file in which to save the key (/home/user/.ssh/id_ed25519):

Press Enter to accept the default location. If you already have an Ed25519 key, it will ask if you want to overwrite it. (Be careful not to overwrite a key you are actively using!).

Step 3: Secure the Key with a Passphrase

You will be prompted to enter a passphrase:

Enter passphrase (empty for no passphrase):

Do not skip this step. If someone steals your laptop or extracts the private key file, a strong passphrase ensures they still cannot use the key to access your servers. Type a secure passphrase and press Enter.

You now have two files in your ~/.ssh/ directory:

• id_ed25519: This is your PRIVATE key. Never share this with anyone. Never upload it to a server.
• id_ed25519.pub: This is your PUBLIC key. This is what you upload to the servers you want to access.

Copying the Public Key to a Remote Server

To use this new key, you must append the contents of the public key to the ~/.ssh/authorized_keys file on the remote server.

The Easy Way (ssh-copy-id)

If you are on a Linux or macOS machine, and you currently have password access to the remote server, you can use the built-in copy command:

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@remote_server_ip

It will prompt you for the remote user’s password one last time, copy the key over, and set the correct file permissions automatically.

The Manual Way

If you don’t have ssh-copy-id (e.g., you are on Windows), you must do it manually.

1. On your local machine, view the public key and copy the output:
   • Linux/Mac: cat ~/.ssh/id_ed25519.pub
   • Windows: type %userprofile%\.ssh\id_ed25519.pub
2. Log into your remote server using your password.
3. Open the authorized_keys file: nano ~/.ssh/authorized_keys
4. Paste the key on a new line and save the file.

Connecting Using the Key

Now, simply SSH into the server as you normally would:

ssh username@remote_server_ip

Instead of the remote server’s password, your local machine will prompt you for the passphrase you created in Step 3. Once entered, you are securely logged in.

Conclusion

Transitioning from legacy RSA keys to modern Ed25519 keys is a mandatory upgrade for any system administrator focused on security and efficiency. The smaller footprint and robust elliptic curve cryptography provide a vastly superior authentication experience across modern Linux environments.