Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the recommended arguments to ssh-keygen for generating a secure ssh keypair these days? The default appears to be 2048 bit RSA, good enough?

I'm using OpenSSH_6.1p1, OpenSSL 1.0.1c 10 May 2012.

share|improve this question
up vote 2 down vote accepted

The default 2048 bit RSA is considered safe until 2030. If that is good enough for you you can generate your keys with the following command:

ssh-keygen -f $HOME/.ssh/rsa_key_file_2048

If you require a key that is safe beyond 2030 a longer key is recommended (3072 bit should suffice). You can define the key size with the -b argument:

ssh-keygen -t rsa -b 3072 -f $HOME/.ssh/rsa_key_file_3072

The result of the commands are two files: the private key as defined by the -f argument, and the public key with the extension .pub.

share|improve this answer
Does anyone have a citation for "considered safe until 2030"? – outofculture Jan 29 at 21:05
@outofculture - The statement is no longer true. 2048-bit key itself is no longer longer consider completely safe, while it would take considerable resources, the industry is moving to larger keys. – Ramhound Jan 29 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .