Android SSH Tunnel with 8192 bit RSA key?

[pcm81]

I am playing around with RSA keys to replace the password authentication for my SSH-2 server. I generated an 8192 bit RSA key in Putty under windows and successfully added the public OpenSSH copy of it to my SSH server. Putty establishes connection without issues. I am looking for a decent Android SSH Tunnel app that supports 8192 bit private keys. Any Suggestions? Tried couple tunneling apps from playstore, but the ones I tried do not work with 8192-bit key. Also would rather stay away from proprietary formatted keys.

Thanks ahead.

 

[mxnerd]

RSA-2048 will last you many, many years.

https://www.digicert.com/TimeTravel/math.htm

RSA-2048 still has fifteen years of life left before it is considered obsolete

https://www.yubico.com/2015/02/big-d...yubicos-stand/

 

[pcm81]

RSA-2048 will last you many, many years.

https://www.digicert.com/TimeTravel/math.htm

RSA-2048 still has fifteen years of life left before it is considered obsolete

https://www.yubico.com/2015/02/big-d...yubicos-stand/

I just figured that if Linux supports 8192, windows putty tunnels with 8192 why not use it on Android as well... Yeah its overkill but why not?

 

[mxnerd]

Your connection is not to central bank and no one is going to hack you.

 

[imort]

I am playing around with RSA keys to replace the password authentication for my SSH-2 server. I generated an 8192 bit RSA key in Putty under windows and successfully added the public OpenSSH copy of it to my SSH server. Putty establishes connection without issues. I am looking for a decent Android SSH Tunnel app that supports 8192 bit private keys. Any Suggestions? Tried couple tunneling apps from playstore, but the ones I tried do not work with 8192-bit key. Also would rather stay away from proprietary formatted keys.

Thanks ahead.

What are you storing in your servers, Death Star blueprints?!

RSA2048 is more than enough for the moment I believe.
Actually, even old 1024 bit keys still can be used, and 4096 keys are the real sign of some paranoia here!

 

[ViviTheMage]

I use juice SSH, looks like it does 8096:

http://www.appdownloaders.com/juicessh-ssh-client/

– Increased maximum Diffie Hellman group modulus length from 1024 to 8192 as per rfc4419

I am not sure if that is key used, or if just generating? I imagine if it generates, it will use it. You can try it, they have a free version.

 

[TheRyuu]

It's more about speed really. If you can afford how slow it is to use a key size that big then go for it. At this point I would start using 4096 keys by default. 1024 is really too small and we're approaching the time when 2048 may also be considered too small although we're not there yet.

We now also have options like ECC[1] which offer the same security but much smaller key sizes so you can look into using them as well if the device supports it. Modern OpenSSH versions support EdDSA[2] along with the NIST curves. I would recommend using either curve25519 which was designed to reduce the risk of implementation errors or nistp521 since it actually has a pretty sane implementation compared with the other two supported.

[1] https://en.wikipedia.org/wiki/Elliptic_curve_cryptography
[2] https://en.wikipedia.org/wiki/EdDSA

 

[sdifox]

Exactly what the hell are you guys doing on your phone?

 

[TheRyuu]

Exactly what the hell are you guys doing on your phone?

I can't speak for everyone else in this thread but I'm simply stating the current best practice, irrespective of where it's used, for ssh and ssh keys. We should be looking at trying to have Boring Crypto[1][2].

[1] https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf
[2] https://news.ycombinator.com/item?id=10345965 (HN discussion of the presentation in [1]).