{{Short description|Component of Secure Shell}} {{Lowercase title}} {{Infobox software | name = ssh-keygen | logo = | screenshot = | screenshot size = | caption = | developer = The OpenBSD Project | released = | latest release version = | latest release date = | repo = {{URL|https://github.com/openssh/openssh-portable/}} | programming language = C | operating system = Unix, Unix-like, Microsoft Windows | genre = Command | license = BSD, ISC, public domain | website = {{URL|https://www.openssh.com/}} }} '''ssh-keygen''' is a standard component of the Secure Shell (SSH) protocol suite found on Unix, Unix-like and Microsoft Windows computer systems used to establish secure shell sessions between remote computers over insecure networks, through the use of various cryptographic techniques. The ssh-keygen utility is used to generate, manage, and convert authentication keys.
==Overview== ssh-keygen is able to generate a key using one of three different digital signature algorithms. With the help of the ssh-keygen tool, a user can create passphrase keys for any of these key types. To provide for unattended operation, the passphrase can be left empty, albeit at increased risk. These keys differ from keys used by the related tool GNU Privacy Guard.
OpenSSH-based client and server programs have been included in Windows 10 since version 1803. The SSH client and key agent are enabled and available by default and the SSH server is an optional Feature-on-Demand.<ref>{{Cite web|url = https://devblogs.microsoft.com/commandline/windows10v1803/|title = What's new for the Command Line in Windows 10 version 1803|date = 8 March 2018|access-date = 25 May 2019|archive-date = 25 May 2019|archive-url = https://web.archive.org/web/20190525123838/https://devblogs.microsoft.com/commandline/windows10v1803/|url-status = live}}</ref><ref>{{Cite web|url = https://devblogs.microsoft.com/powershell/using-the-openssh-beta-in-windows-10-fall-creators-update-and-windows-server-1709/|title = Using the OpenSSH Beta in Windows 10 Fall Creators Update and Windows Server 1709|date = 15 December 2017|access-date = 25 May 2019|archive-date = 25 May 2019|archive-url = https://web.archive.org/web/20190525125356/https://devblogs.microsoft.com/powershell/using-the-openssh-beta-in-windows-10-fall-creators-update-and-windows-server-1709/|url-status = live}}</ref>
==Key formats supported== Example: <code><nowiki>ssh-keygen -t rsa</nowiki></code> <ref>{{cite web | url=https://man7.org/linux/man-pages/man1/ssh-keygen.1.html | title=SSH-keygen(1) - Linux manual page }}</ref> {| class="wikitable" |- ! Protocol !! -t option || Creation Date !! Status in 2025 |- | '''RSA'''|| <code><nowiki>rsa</nowiki></code>|| 1977||Universally supported among SSH clients |- | DSA || <code><nowiki>dsa</nowiki></code>|| 1991||Deprecated in 2013<ref>{{Cite web|url=https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf|title=Withdrawn NIST Technical Series Publication|website=nvlpubs.nist.gov|access-date=2024-07-30|archive-date=2024-08-17|archive-url=https://web.archive.org/web/20240817143716/https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf|url-status=live}}</ref> |- | ECDSA|| <code><nowiki>ecdsa</nowiki></code>|| 1999||Vulnerable<ref>{{cite web | url=https://www.halborn.com/blog/post/how-hackers-can-exploit-weak-ecdsa-signatures | title=How Hackers Can Exploit Weak ECDSA Signatures | date=26 July 2021 | access-date=30 July 2024 | archive-date=30 July 2024 | archive-url=https://web.archive.org/web/20240730162407/https://www.halborn.com/blog/post/how-hackers-can-exploit-weak-ecdsa-signatures | url-status=live }}</ref> |- | '''EDDSA''' || <code><nowiki>ed25519</nowiki></code>|| 2005||Performs faster than RSA with significantly smaller keys<ref>{{cite web | url=https://goteleport.com/blog/comparing-ssh-keys/ | title=Comparing SSH Keys - RSA, DSA, ECDSA, or EdDSA? }}</ref> |}
Originally, with SSH protocol version 1 (now deprecated) only the RSA algorithm was supported. As of 2016, RSA is still considered strong, but the recommended key length has increased over time.
The SSH protocol version 2 additionally introduced support for the DSA algorithm. DSA is now considered weak and was disabled in OpenSSH 7.0.
Subsequently, OpenSSH added support for a third digital signature algorithm, ECDSA (this key format no longer uses the previous PEM file format for private keys, nor does it depend upon the OpenSSL library to provide the cryptographic implementation).
A fourth format is supported using Ed25519, originally developed by independent cryptography researcher Daniel J. Bernstein.
==Command syntax== The syntax of the ssh-keygen command is as follows:
ssh-keygen [options]
Some important options of the ssh-keygen command are as follows:
{| class="wikitable" |- ! ssh-keygen command options ! description |- | -b bits | Specifies the number of bits in the key to create. The default length is 3072 bits (RSA) or 256 bits (ECDSA). |- | -C comment | Provides custom key comment (which will be appended at the end of the public key). |- | -K | Imports a private resident key from a FIDO2 device. |- | -p | Requests changing the passphrase of a private key file instead of creating a new private key. |- | -t | Specifies the type of key to create (e.g., rsa). |- | -o | Use the new OpenSSH format. |- | -q | quiets ssh-keygen. It is used by the /etc/rc file while creating a new key. |- | -N | Provides a new Passphrase. |- | -B | Dumps the key's fingerprint in Bubble Babble format. |- | -l | Dumps the key's fingerprint in SHA-2 (or MD5) format. |}
==Files used by the ssh-keygen utility== The ssh-keygen utility generates files for storing public and private keys. Note : they are stored in '''$HOME/.ssh/''' as follows:
=== SSH protocol version 2 === {| class="wikitable" |+ Quick Recap |- ! scope=col | Algorithm ! scope=col | Private ! scope=col | Public |- |RSA | id_rsa | id_rsa.pub |- |DSA | id_dsa | id_dsa.pub |- |ECDSA | id_ecdsa | id_ecdsa.pub |- |ed25519 | id_ed25519 | id_ed25519.pub |} * The {{code|$HOME/.ssh/id_dsa}} file contains the protocol version 2 DSA authentication identity of the user. * The {{code|$HOME/.ssh/id_dsa.pub}} file contains the DSA public key for authentication when you are using the SSH protocol version 2. ** A user should copy its contents in the {{code|$HOME/.ssh/authorized_keys}} file of the remote system where a user wants to log in using DSA authentication. * The {{code|$HOME/.ssh/id_rsa}} file contains the protocol version 2 RSA authentication identity of the user. ** This file should not be readable by anyone but the user. * The {{code|$HOME/.ssh/id_rsa.pub}} file contains the protocol version 2 RSA public key for authentication. ** The contents of this file should be added to {{code|$HOME/.ssh/authorized_keys}} on all computers where a user wishes to log in using public key authentication.
=== SSH protocol version 1 === * The {{code|$HOME/.ssh/identity}} file contains the RSA private key when using the SSH protocol version 1. * The {{code|$HOME/.ssh/identity.pub}} file contains the RSA public key for authentication when you are using the SSH protocol version 1. ** A user should copy its contents in the {{code|$HOME/.ssh/authorized_keys}} file of the remote system where a user wants to log in using RSA authentication.
==References== {{Reflist}}
==External links== {{Wikibooks | OpenSSH | Utilities#ssh-keygen | ssh-keygen}} * [https://help.github.com/articles/generating-an-ssh-key Generating an SSH key], a guide from GitHub * [https://man.openbsd.org/OpenBSD-current/man1/ssh-keygen.1#NAME ssh-keygen manual] from the OpenBSD project * [http://linux.die.net/man/1/ssh-keygen Linux man page] from [http://linux.die.net die.net] * [https://ifixlinux.com/post/how-to-generate-ssh-key-on-mac-linux/ Generating SSH Key Pair on Linux and Mac] from [https://ifixlinux.com ifixlinux.com] * [https://www.ssh.com/academy/ssh-keys Basic overview of SSH Keys] from SSH * [https://www.ssh.com/academy/ssh/keygen How to Use ssh-keygen to Generate a New SSH Key?] from SSH * [https://www.atlassian.com/git/tutorials/git-ssh What is a Git SSH Key?] from Atlassian * [https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server How to Create an SSH Key in Linux: Easy Step-by-Step Guide] from DigitalOcean * [https://docs.oracle.com/en/cloud/cloud-at-customer/occ-get-started/generate-ssh-key-pair.html Getting Started with Oracle Cloud at Customer] on Oracle * [https://git-scm.com/book/ms/v2/Git-on-the-Server-Generating-Your-SSH-Public-Key Git on the Server - Generating Your SSH Public Key] on Git-SCM {{Unix commands}} {{Windows commands}}
Category:Operating system security Category:Unix network-related software Category:Secure Shell