OpenSSH Key Generation

This guide will show you how to generate OpenSSH keys on Linux.

Prerequisites

Make sure you have the openssh-server package installed.

sudo apt-get update
sudo apt-get install openssh-server

Generate OpenSSH Key (Recommended: Ed25519)

Ed25519 is the preferred modern key type — it's faster, more secure, and produces shorter keys than RSA.

# generate an Ed25519 key (recommended)
ssh-keygen -t ed25519

This will prompt you for a passphrase (you can leave it blank if you don't want to use one), ask you for the location of the key file, and then generate a private key (default id_ed25519) and a public key file (default id_ed25519.pub).

Generate RSA Key (legacy/compatibility)

If you're on an older system that doesn't support Ed25519, use RSA with at least 4096 bits:

# generate an RSA key
ssh-keygen -t rsa -b 4096

This will generate a private key file id_rsa and a public key file id_rsa.pub.

Key type options

-b flag specifies the number of bits in the key to create. For RSA keys, the minimum size is 1024 bits and the default is 3072 bits. Generally, 3072 bits is considered sufficient. For ECDSA keys, the -b flag determines the key length by selecting from one of three elliptic curve sizes: 256, 384 or 521 bits. Attempting to use bit lengths other than these three values for ECDSA keys will fail. ECDSA-SK, Ed25519 and Ed25519-SK keys have a fixed length and the -b flag will be ignored.