ssh-keygen

ssh-keygen
Developer(s)	The OpenBSD Project
Repository	github.com/openssh/openssh-portable/
Written in	C
Operating system	Unix, Unix-like, Microsoft Windows
Type	Command
License	BSD, ISC, public domain
Website	www.openssh.com

ssh-keygen is a standard component of the Secure Shell (SSH) protocol suite found on Unix, Unix-like and Microsoft Windows computer systems used to establish secure shell sessions between remote computers over insecure networks, through the use of various cryptographic techniques. The ssh-keygen utility is used to generate, manage, and convert authentication keys.

Overview

ssh-keygen is able to generate a key using one of three different digital signature algorithms. With the help of the ssh-keygen tool, a user can create passphrase keys for any of these key types. To provide for unattended operation, the passphrase can be left empty, albeit at increased risk. These keys differ from keys used by the related tool GNU Privacy Guard.

OpenSSH-based client and server programs have been included in Windows 10 since version 1803. The SSH client and key agent are enabled and available by default and the SSH server is an optional Feature-on-Demand.^[1]^[2]

Key formats supported

Example: ssh-keygen -t rsa RTFM^[3]

Protocol	-t option	Creation Date	Status in 2024
RSA	`rsa`	1977	Universally supported among SSH clients
DSA	`dsa`	1991	Deprecated in 2013^[4]
ECDSA	`ecdsa`	1999	Vulnerable ^[5]
EDDSA	`ed25519`	2005	Performs faster than RSA with significantly smaller keys^[6]

Originally, with SSH protocol version 1 (now deprecated) only the RSA algorithm was supported. As of 2016, RSA is still considered strong, but the recommended key length has increased over time.

The SSH protocol version 2 additionally introduced support for the DSA algorithm. DSA is now considered weak and was disabled in OpenSSH 7.0.

Subsequently, OpenSSH added support for a third digital signature algorithm, ECDSA (this key format no longer uses the previous PEM file format for private keys, nor does it depend upon the OpenSSL library to provide the cryptographic implementation).

A fourth format is supported using Ed25519, originally developed by independent cryptography researcher Daniel J. Bernstein.

Command syntax

The syntax of the ssh-keygen command is as follows:

ssh-keygen [options]

Some important options of the ssh-keygen command are as follows:

ssh-keygen command options	description
-b bits	Specifies the number of bits in the key to create. The default length is 3072 bits (RSA) or 256 bits (ECDSA).
-C comment	Provides custom key comment (which will be appended at the end of the public key).
-K	Imports a private resident key from a FIDO2 device.
-p	Requests changing the passphrase of a private key file instead of creating a new private key.
-t	Specifies the type of key to create (e.g., rsa).
-o	Use the new OpenSSH format.
-q	quiets ssh-keygen. It is used by the /etc/rc file while creating a new key.
-N	Provides a new Passphrase.
-B	Dumps the key's fingerprint in Bubble Babble format.
-l	Dumps the key's fingerprint in SHA-2 (or MD5) format.

Files used by the ssh-keygen utility

The ssh-keygen utility generates files for storing public and private keys. Note : they are stored in $HOME/.ssh/ as follows:

SSH protocol version 2

Quick Recap
Algorithm	Private	Public
RSA	id_rsa	id_rsa.pub
DSA	id_dsa	id_dsa.pub
ECDSA	id_ecdsa	id_ecdsa.pub
ed25519	id_ed25519	id_ed25519.pub

$HOME/.ssh/id_dsa: The $HOME/.ssh/id_dsa file contains the protocol version 2 DSA authentication identity of the user.
$HOME/.ssh/id_dsa.pub: The $HOME/.ssh/id_dsa.pub file contains the DSA public key for authentication when you are using the SSH protocol version 2. A user should copy its contents in the $HOME/.ssh/authorized_keys file of the remote system where a user wants to log in using DSA authentication.
$HOME/.ssh/id_rsa: The $HOME/.ssh/id_rsa file contains the protocol version 2 RSA authentication identity of the user. This file should not be readable by anyone but the user.
$HOME/.ssh/id_rsa.pub: The $HOME/.ssh/id_rsa.pub file contains the protocol version 2 RSA public key for authentication. The contents of this file should be added to $HOME/.ssh/authorized_keys on all computers where a user wishes to log in using public key authentication.

SSH protocol version 1

$HOME/.ssh/identity: The $HOME/.ssh/identity file contains the RSA private key when using the SSH protocol version 1.
$HOME/.ssh/identity.pub: The $HOME/.ssh/identity.pub file contains the RSA public key for authentication when you are using the SSH protocol version 1. A user should copy its contents in the $HOME/.ssh/authorized_keys file of the remote system where a user wants to log in using RSA authentication.

References

^ "What's new for the Command Line in Windows 10 version 1803". 8 March 2018.
^ "Using the OpenSSH Beta in Windows 10 Fall Creators Update and Windows Server 1709". 15 December 2017.
^ "SSH-keygen(1) - Linux manual page".
^ https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf ^{[bare URL PDF]}
^ "How Hackers Can Exploit Weak ECDSA Signatures". 26 July 2021.
^ "Comparing SSH Keys - RSA, DSA, ECDSA, or EdDSA?".

External links

Generating an SSH key, a guide from GitHub
ssh-keygen manual from the OpenBSD project
Linux man page from die.net
Generating SSH Key Pair on Linux and Mac from ifixlinux.com

[1] "What's new for the Command Line in Windows 10 version 1803". 8 March 2018.

[2] "Using the OpenSSH Beta in Windows 10 Fall Creators Update and Windows Server 1709". 15 December 2017.

[3] "SSH-keygen(1) - Linux manual page".

[4] ttps://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf ^{[bare URL PDF]}

[5] "How Hackers Can Exploit Weak ECDSA Signatures". 26 July 2021.

[6] "Comparing SSH Keys - RSA, DSA, ECDSA, or EdDSA?".

[1]

[2]

[3]

[4]

[5]

[6]

v t e Unix command-line interface programs and shell builtins
File system	cat chattr chmod chown chgrp cksum cmp cp dd du df file fuser ln ls mkdir mv pax pwd rm rmdir split tee touch type umask
Processes	at bg crontab fg kill nice ps time
User environment	env exit logname mesg talk tput uname who write
Text processing	awk basename comm csplit cut diff dirname ed ex fold head iconv join m4 more nl paste patch printf read sed sort strings tail tr troff uniq vi wc xargs
Shell builtins	alias cd echo test unset wait
Searching	find grep
Documentation	man
Software development	ar ctags lex make nm strip yacc
Miscellaneous	bc cal expr lp od sleep true and false
Categories Standard Unix programs Unix SUS2008 utilities List

v t e Windows command-line programs and shell builtins
COMMAND.COM Command Prompt Windows PowerShell Recovery Console
File system navigation	cd (chdir) dir popd pushd tree
File management	attrib cacls cipher compact copy del (erase) deltree icacls mkdir (md) mklink move openfiles recover ren (rename) replace rmdir (rd) robocopy takeown xcopy
Archiving	expand extrac32 extract makecab pax tar
Disk management	chkdsk convert defrag diskcomp diskcopy diskpart diskraid diskshadow drvspace fdisk format fsutil label manage-bde refsutil subst scandisk sys vol vssadmin
Processes	at exit kill powercfg runas sc schtasks shutdown start taskkill tasklist
Registry	assoc ftype reg regini regsvr32
User environment	chcp cmdkey date graftabl mode path set setver setx time title ver where whoami
File contents	comp edit edlin fc find findstr print type
Scripting	choice clip cscript doskey echo for forfiles goto if more pause prompt rem timeout
Networking	arp bitsadmin curl getmac hostname ipconfig nbtstat net netsh netstat nslookup PathPing ping rpcping route scp setspn sftp ssh ssh-add ssh-agent ssh-keygen ssh-keyscan tracert winrm winrs
Maintenance and care	auditpol dispdiag driverquery eventcreate eventtriggers logman mofcomp msiexec ntbackup pnpunattend pnputil REAgentC relog sfc sxstrace systeminfo tracerpt typeperf w32tm WBAdmin wecutil wevtutil winmgmt winsat wmic
Boot management	bcdedit bootcfg bootsect fixboot fixmbr
Software development	debug exe2bin QBasic
Miscellaneous	break cls dism dpath gpresult gpupdate help MSCDEX pentnt tpmtool tpmvscmgr wsl
List of DOS commands Environment variables Windows Support Tools