安全与隐私blog.g3rt.nl
升级你的 SSH 密钥
Upgrade your SSH keys
2016 — 2021，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这篇博客介绍如何升级 SSH 密钥：生成新的更安全密钥并替换旧密钥，涉及 ssh-keygen 的算法与参数选择。它因此在 Hacker News 上引发了对默认安全性、RSA 与 Ed25519 路线以及各平台工具选择的长期讨论。
为什么经久不衰：SSH 密钥是每天都会用到的长期安全基础设施，而默认算法和工具支持多年间不断变化，所以这篇升级指南今天仍值得拿来对照检查。
HN 评论精选
默认配置就应足够安全，需要额外参数才安全说明工具设计失败。
ssh-keygen 的默认选项就应该满足所有需求。如果还需要传参数才能提高生成密钥的安全性，那这个软件就完全失败了。传参只应该用于回退到较不安全的选项；没有任何理由给 ssh-keygen 传参，若真有必要，那这个软件包的安装就是不可原谅地坏了。
developer2查看英文原文
Seriously, the default options to ssh-keygen should be all anybody needs. If you need to pass arguments to increase the security of the generated key, then the software has completely failed its purpose. Passing arguments should only be for falling back on less secure options, if there is some limiting factor for a particular deployment. There is absolutely no reason to pass arguments to ssh-keygen. If it is actually deemed necessary to do so, then that package's installation is inexcusably broken.
RSA 仍是保守可靠的选择，椭圆曲线的优势在多数 SSH 场景未必关键。
我不理解 RSA 为何招来“仇恨”。椭圆曲线有前景，也更小更快；但 RSA 并没有被攻破，理解充分，“无聊”通常是安全上的优点，位数也更大，不被 NSA 推动，专家也不认为它是坏选择。几年前 Bruce Schneier 还因 NSA 推动而怀疑 EC；我也信任 djb，Ed25519 是好算法，Tor 等项目确实受益，但多数 SSH 场景并不是瓶颈。所以从保守角度看 RSA 可能更稳妥，担心就加位数。我这样想错了吗？
tete查看英文原文
Something I don't understand is the "hate" that RSA gets. Yeah, Elliptic Curves are promising, have benefits (smaller/faster). But RSA isn't broken, it is well understood, is "boring" (a plus on security, usually), has bigger bit sizes (according to people that know a lot more to me that's a plus point, regardless of EC requiring smaller ones, because of certain attacks), isn't hyped and sponsored by the NSA and isn't considered a bad choice by experts. Not too many years ago Bruce Schneier was skeptical about EC, because of the NSA pushing for it. Now, I also trust djb and i an sure that ed25519 is a good cipher and there are many projects, like Tor that actually benefit from it, increasing throughput, etc., but for most use cases of SSH that might not be the issue, nor the bottleneck. So from my naive, inexperienced point of view RSA might seem the more conservative option. And if I was worried about security I'd increase the bit size. Am I going wrong here?
因量子计算风险，建议继续用大位数 RSA 而不是 Ed25519。
我不同意作者。升级到 ed25519 前要注意，NSA/NIST 正因为椭圆曲线密码对量子攻击很脆弱而转向。引文的大意是：尽管量子计算机还很遥远、可用的抗量子替代算法也看不到，NSA 仍公开宣布不要升级到 Suite B；实际上这意味着一些公司会继续用 RSA。RSA 也受量子攻击影响，但没 ECC 那么严重。还是坚持久经考验的 RSA，用 4097 位甚至 8192 位。用 ed25519 没有可感知的用户收益，而且并非到处都支持；等可用的量子计算机开始破解一切时，你也不用轮换所有密钥。
matt_wulfeck查看英文原文
I disagree with the author. Before you go upgrading into ed25519, beware that the NSA/NIST is moving away from elliptical curve cryptography because it's very vulnerable to cracking with quantum attacks[0]. "So let me spell this out: despite the fact that quantum computers seem to be a long ways off and reasonable quantum-resistant replacement algorithms are nowhere to be seen, NSA decided to make this announcement publicly and not quietly behind the scenes. Weirder still, if you haven’t yet upgraded to Suite B, you are now being urged not to. In practice, that means some firms will stay with algorithms like RSA rather than transitioning to ECC at all. And RSA is also vulnerable to quantum attacks." Stick with the battle tested RSA keys, which are susceptible but not as much as ECC crypto. 4097 or even better 8192-bit lengths. There's no perceptible user benefits to using ed25519 and it's not even supported everywhere. Also you won't have to rotate all of your keys when workable quantum computers start crackin' everything. [0] https://blog.cryptographyengineering.com/2015/10/22/a-riddle-wrapped-in-curve/
Windows 用户应改用内置 OpenSSH 和现代终端，而不是 PuTTY。
2021 年在 Windows 上用 PuTTY 要自担风险。它二十年前是重要工具，但它的时代已经过去了。Windows 10 已内置“真正的” OpenSSH 客户端（服务器端可作为可选功能），终端体验则可用 Windows Terminal（或按喜好用 ConEmu/Cmder）来替代 PuTTY 过去提供的东西。
WorldMaker查看英文原文
On Windows use PuTTY at own risk in 2021. It was an important tool two decades ago, but its time has sunset. Windows 10 has "real" OpenSSH client available as a built-in feature (and server available as an optional feature). Use Windows Terminal (or ConEmu/Cmder, per preference) for the terminal experience upgrades PuTTY used to provide.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选