ui_puttygen » Revisions »
Differences
This shows you the differences between the selected revisions of the page.
| 2023-01-05 | 2023-02-13 | ||
| Restored revision 1654770365. Undoing revision 1672913761. (martin) (hidden) | 6.0 Bug 1873: Support for OpenSSH certificates + other updates from PuTTY docs (martin) | ||
| Line 44: | Line 44: | ||
| The //Number of bits// input box allows you to choose the strength of the key PuTTYgen will generate. | The //Number of bits// input box allows you to choose the strength of the key PuTTYgen will generate. | ||
| - | * For RSA and DSA, 2048 bits should currently be sufficient for most purposes. | + | * For RSA and DSA, 2048 bits should currently be sufficient for most purposes. (Smaller keys of these types are no longer considered secure, and PuTTYgen will warn if you try to generate them.) |
| - | * For ECDSA, only 256, 384, and 521 bits are supported. (%%ECDSA%% offers equivalent security to %%RSA%% with smaller key sizes.)· | + | * For ECDSA, only 256, 384, and 521 bits are supported, corresponding to NIST-standardised elliptic curves. (Elliptic-curve keys do not need as many bits as RSA keys for equivalent security, so these numbers are smaller than the %%RSA%% recommendations.) |
| * For EdDSA, the only valid sizes are 255 bits (these keys are also known as Ed25519 and are commonly used) and 448 bits (Ed448, which is much less common at the time of writing). (256 is also accepted for backward compatibility, but the effect is the same as 255.) | * For EdDSA, the only valid sizes are 255 bits (these keys are also known as Ed25519 and are commonly used) and 448 bits (Ed448, which is much less common at the time of writing). (256 is also accepted for backward compatibility, but the effect is the same as 255.) | ||
| ===== [[method]] Selecting the Prime Generation Method ===== | ===== [[method]] Selecting the Prime Generation Method ===== | ||
| + | |||
| + | (This is entirely optional. Unless you know better, it's entirely sensible to skip this and use the default settings.) | ||
| On the //Key// menu, you can also optionally change the method for generating the prime numbers used in the generated key. This is used for RSA and DSA keys only. (The other key types don't require generating prime numbers at all.) | On the //Key// menu, you can also optionally change the method for generating the prime numbers used in the generated key. This is used for RSA and DSA keys only. (The other key types don't require generating prime numbers at all.) | ||
| The prime-generation method does not affect compatibility: a key generated with any of these methods will still work with all the same SSH servers. | The prime-generation method does not affect compatibility: a key generated with any of these methods will still work with all the same SSH servers. | ||
| - | |||
| - | If you don't care about this, it's entirely sensible to leave it on the default setting. | ||
| The available methods are: | The available methods are: | ||
| Line 115: | Line 115: | ||
| Do not forget your passphrase. There is no way to recover it. | Do not forget your passphrase. There is no way to recover it. | ||
| + | |||
| + | ===== [[certificate]] Adding a certificate to your key ===== | ||
| + | |||
| + | In some environments, user authentication keys can be signed in turn by a certifying authority (CA for short), and user accounts on an SSH server can be configured to automatically trust any key that's certified by the right signature. | ||
| + | |||
| + | This can be a convenient setup if you have a very large number of servers. When you change your key pair, you might otherwise have to [[guide_public_key#configure_openssh|edit the ''authorized_keys'' file]] (in case of OpenSSH) on every server individually, to make them all accept the new key. But if instead you configure all those servers once to accept keys signed as yours by a CA, then when you change your public key, all you have to do is to get the new key certified by the same CA as before, and then all your servers will automatically accept it without needing individual reconfiguration. | ||
| + | |||
| + | To get your key signed by a CA, you'll probably send the CA the new public key (not the private half), and get back a modified version of the public key with the certificate included. | ||
| + | |||
| + | If you want to incorporate the certificate into your PPK file for convenience, you can use the //Add certificate to key// menu option in PuTTYgen's //Key// menu. This will give you a single file containing your private key and the certificate, which is everything you need to authenticate to a server prepared to accept that certificate. | ||
| + | |||
| + | To remove the certificate again and restore the uncertified PPK file, there's also a //Remove certificate from key// option. | ||
| + | |||
| + | (However, you don't have to incorporate the certificate into your PPK file. You can equally well use it separately, via the [[ui_login_authentication#certificate|//Certificate to use with the private key// option]] in WinSCP itself. It's up to you which you find more convenient.) | ||
| + | |||
| + | When the currently loaded key in PuTTYgen contains a certificate, the large [[#authorized_keys|//Public key for pasting// edit box]] is replaced by a button that brings up an information box telling you about the certificate, such as who it certifies your key as belonging to, when it expires (if ever), and the fingerprint of the CA key that signed it in turn. | ||
| + | |||
| + | //Tis feature is available in PuTTYgen 0.78 included with latest beta version only.// &beta | ||
| ===== [[saving_private]] Saving Your Private Key to a Disk File ===== | ===== [[saving_private]] Saving Your Private Key to a Disk File ===== | ||
| Line 203: | Line 221: | ||
| The options supported on the PuTTYgen command line are: | The options supported on the PuTTYgen command line are: | ||
| - | | ''-t <keytype>'' | [[#type|Type of key]] to generate. You can select ''rsa'', ''dsa'', ''ecdsa'' or ''eddsa''. | | + | | ''-t <keytype>'' | [[#type|Type of key]] to generate. You can select ''rsa'', ''dsa'', ''ecdsa'', ''eddsa'', ''ed25519'' or ''ed448'' //(the last three in PuTTYgen 0.78 included with latest beta version only)// &beta | |
| | ''-b <bits>'' | [[#size|Size of the key]] to generate, in bits. | | | ''-b <bits>'' | [[#size|Size of the key]] to generate, in bits. | | ||
| | ''%%--primes <method>%%'' | [[#method|Method for generating prime numbers]]. You can select ''probable'', ''proven'', and ''proven-even''. | | | ''%%--primes <method>%%'' | [[#method|Method for generating prime numbers]]. You can select ''probable'', ''proven'', and ''proven-even''. | | ||