108

Is one more secure than the other?

5 Answers 5

72

id_rsa.pub and id_dsa.pub are the public keys for id_rsa and id_dsa.

If you are asking in relation to SSH, id_rsa is an RSA key and can be used with the SSH protocol 1 or 2, whereas id_dsa is a DSA key and can only be used with SSH protocol 2. Both are very secure, but DSA does seem to be the standard these days (assuming all your clients/servers support SSH 2).

Update: Since this was written DSA has been shown to be insecure. More information available in Adam Katz's answer.

3
  • 1
    I must disagree with this. Today (and, though to a lesser extent, also in 2010 when this was posted), 1024 bits (the largest key size available to DSA) is considered too weak. Therefore, RSA is the better option. As to SSH v1: I didn't consider this secure ten years ago.
    – Adam Katz
    May 31, 2015 at 23:28
  • 4
    @AdamKatz DSA has supported support 2048-bit and 3072-bit keys since 2009 (as per FIPS 186-3). Most ssh clients/servers support larger DSA keys including OpenSSH and PuTTY. Most key generators also support larger DSA keys, but ssh-keygen from OpenSSH still does not (even though both ssh and sshd do). For Linux, you can generate larger DSA keys using OpenSSL as described in this blog post. Jun 11, 2015 at 17:06
  • 2
    Interesting! I hadn't known that, and that certainly helps level the field between the two (though the lack of OpenSSH support is pretty damning). Still, I wouldn't say that DSA is the standard (either now or in 2010), while RSA absolutely is (and we're transitioning to elliptical curve systems like Ed25519).
    – Adam Katz
    Jun 12, 2015 at 1:43
62

SSH uses public/private key pairs, so id_rsa is your RSA private key (based on prime numbers), which is more secure than your id_dsa DSA private key (based on exponents). Keep your private keys safe and share your id_rsa.pub and id_dsa.pub public keys broadly.

DSA is insecure

DSA has a guessable parameter if your computer's random number generator is sub par, which will reveal your secret key. ECDSA (DSA's elliptical curve upgrade) is similarly vulnerable. Even with good random numbers, DSA has other strength concernsPDF/🎬 (these are also found in Diffie-Hellman).

OpenSSH creates insecure 1024 bit keys(workaround) and now disables DSA by default.

Prefer Ed25519

Elliptic curve cryptography offers increased complexity with smaller key sizes. Ed25519 (based on the complexity of plane-modeled elliptical curves) is the preferred implementation due to its assumed lack of meddling (leaked documents show that the US NSA weakens crypto standards).

Ed25519 was introduced in OpenSSH 6.5 (2014-01-30) and GnuPG 2.1 (2014-11-06) and became the default ("first-preference") in OpenSSH 8.5 (2021-03-03). Older systems may not yet accept Ed25519, but the list of supported implementations has been growing steadily.

Use RSA with 4096 bits when Ed25519 is unavailable

RSA key sizes of 4096 bits using the signature variant of rsa-sha2-512 (added in OpenSSH 7.2, 2016-02-29, default in OpenSSH 8.2, 2020-02-14) should have comparable complexity to Ed25519.

Ed25519 is still preferred to RSA due to a worry that RSA may be vulnerable to the same strength concerns as DSA, though applying that exploit to RSA is expected to be considerably harder.

4
  • 3
    Just one correction: DSA has supported 2048-bit and 3072-bit keys since 2009 (as per FIPS 186-3). More information in my comment above. Jun 11, 2015 at 17:19
  • 3
    Infosec SE has a nice answer to this question that goes into more depth. It cites a Black Hat 2013 talk that suggests DSA is no longer secure, even at larger key sizes.
    – Adam Katz
    Dec 6, 2015 at 23:11
  • 3
    I've updated this answer to be more comprehensive about the issues with DSA. It is now more detailed than the (equally valid) Infosec SE answer. There's even more detail when you hover your mouse over some of the links.
    – Adam Katz
    Jan 9, 2016 at 3:06
  • 2
    This post taught me so much, needs so much more upvotes.
    – lilHar
    Oct 7, 2019 at 20:20
7

rsa is considered more secure.

Not anymore (May 2020, ten years later), with OpenSSH 8.2, as reported by Julio

Future deprecation notice

It is now possible1 to perform chosen-prefix attacks against the SHA-1 hash algorithm for less than USD$50K.
For this reason, we will be disabling the "ssh-rsa" public key signature algorithm that depends on SHA-1 by default in a near-future release.

(See "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust" Leurent, G and Peyrin, T (2020))

This algorithm is unfortunately still used widely despite the existence of better alternatives, being the only remaining public key signature algorithm specified by the original SSH RFCs.

The better alternatives include:

  • The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512.
    These algorithms have the advantage of using the same key type as "ssh-rsa", but use the safe SHA-2 hash algorithms.
    These have been supported since OpenSSH 7.2 and are already used by default if the client and server support them.

  • The ssh-ed25519 signature algorithm.
    It has been supported in OpenSSH since release 6.5.

  • The RFC5656 ECDSA algorithms: ecdsa-sha2-nistp256/384/521.
    These have been supported by OpenSSH since release 5.7.

To check whether a server is using the weak ssh-rsa public key algorithm for host authentication, try to connect to it after removing the ssh-rsa algorithm from ssh(1)'s allowed list:

ssh -oHostKeyAlgorithms=-ssh-rsa user@host

If the host key verification fails and no other supported host key types are available, the server software on that host should be upgraded.

A future release of OpenSSH will enable UpdateHostKeys by default to allow the client to automatically migrate to better algorithms.
Users may consider enabling this option manually.


Adam Katz clarifies in the comments:

As you noted, the default RSA signature variant has been rsa-sha2-512 since OpenSSH 7.2 (2016). This addresses the SHA-1 weakness and serves as a reminder that RSA itself is still considered secure. UpdateHostKeys has been enabled by default since OpenSSH 8.2 (Feb 2020). Any form of RSA is more secure than any form of DSA, though nowadays you should prefer ed25519 as explained in my answer.

So to be clear, DSA is not really a "better alternative".

Adam adds:

[This] could be read as suggesting DSA is more secure than RSA and that RSA should not be used.

Neither of those are true, though RSA keys generated before 2016 and deployed on systems running OpenSSH < 8.2 should be updated manually.

4
  • As you noted, the default RSA signature variant has been rsa-sha2-512 since OpenSSH 7.2 (2016). This addresses the SHA-1 weakness and serves as a reminder that RSA itself is still considered secure. UpdateHostKeys has been enabled by default since OpenSSH 8.2 (Feb 2020). Any form of RSA is more secure than any form of DSA, though nowadays you should prefer ed25519 as explained in my answer.
    – Adam Katz
    Oct 15 at 19:40
  • @AdamKatz True. Is there any recent evolution which prompted you to make that comment?
    – VonC
    Oct 15 at 19:44
  • Only that I just saw your answer, which could be read as suggesting DSA is more secure than RSA and that RSA should not be used. Neither of those are true, though RSA keys generated before 2016 and deployed on systems running OpenSSH < 8.2 should be updated manually.
    – Adam Katz
    Oct 15 at 19:48
  • @AdamKatz OK, thank you for this feedback. I have included your comment in the answer for more visibility.
    – VonC
    Oct 15 at 19:56
1

Yes, rsa is considered more secure.

In October 2014, OpenSSH 7 (the default with Ubuntu 16.04LTS) has disabled default support for DSA. Take this as a strong sign that DSA is not a recommended method anymore.

https://www.gentoo.org/support/news-items/2015-08-13-openssh-weak-keys.html

-10

One uses DSA and one uses RSA.

2
  • assuming you are just using the default names (which logically that looks like it), theatrus hit it right on the head. May 12, 2010 at 18:43
  • You did not answer the real part of the question: which is more secure. Downvoting since this was the topmost answer. Does not need to be.
    – akauppi
    Aug 2, 2016 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.