I am a bit lost in understanding what I read on authentication, signature, etc. For instance, is the size of the ECDSA keys produced by ssh-keygen -t ecdsa -b 256 linked to the hash used (SHA256) when computing the signature?
$\begingroup$
$\endgroup$
6
-
4$\begingroup$ This question appears to be off-topic because it is about using openssh rather than cryptography. $\endgroup$– otusCommented Oct 24, 2014 at 15:11
-
$\begingroup$ However, that command does create a key for ecdh-sha2-nistp256, which uses SHA-256. $\endgroup$– otusCommented Oct 24, 2014 at 15:13
-
$\begingroup$ @otus I was wondering, so I provided the answer myself and flagged it for transfer to IT security. $\endgroup$– Maarten Bodewes ♦Commented Oct 24, 2014 at 15:39
-
$\begingroup$ @owlstead, this could actually probably be rephrased so it's on topic here, but Security may be a better fit. $\endgroup$– otusCommented Oct 24, 2014 at 15:43
-
1$\begingroup$ I've just now made the question and answer generic so it should now fit the crypto standards here. The question seems reasonable to me and apparently it is considered useful. $\endgroup$– Maarten Bodewes ♦Commented Mar 6, 2015 at 11:05
|
Show 1 more comment
1 Answer
$\begingroup$
$\endgroup$
2
No, in general the hash isn't determined by the curve definition by NIST. Reasonable mappings of course exist (for a 224 bit curve you would probably use a hash with output size of 224 such as SHA-224). The hash used should however be specified by the protocol itself.
The ECDSA key size as indicated by the -b of the openssh argument is linked to the hash algorithm used. This is defined in section 6.2.1 of the RFC 5656:
The Elliptic Curve Digital Signature Algorithm (ECDSA) is specified for use with the SSH ECC public key algorithm.
The hashing algorithm defined by this family of method names is the SHA2 family of hashing algorithms [FIPS-180-3]. The algorithm from the SHA2 family that will be used is chosen based on the size of the named curve specified in the public key:
+----------------+----------------+
| Curve Size | Hash Algorithm |
+----------------+----------------+
| b <= 256 | SHA-256 |
| | |
| 256 < b <= 384 | SHA-384 |
| | |
| 384 < b | SHA-512 |
+----------------+----------------+
Note that currently you can only use the P-256, P-384 and P-521 (secp256r1, secp384r1 and secp521r1) prime curves defined by NIST in SSH. So the argument for the bit size also determines the domain parameters used.
answered Oct 24, 2014 at 15:38
-
$\begingroup$ Excellent answer, is it correct that a 521 bit curve should ideally use a hash with output size >= 521 bits? $\endgroup$– FrodeCommented Feb 26, 2018 at 18:37
-
1$\begingroup$ Ideally yes, but 1. that kind of hash will be hard to find, and 2. a curve of 521 bits should provide 260 bits of protection against attacks using classical computers (as far as we know). So just use SHA-2 or 3 with 512 bits output size as any security over 256 bits - the security strength of those hashes - is hogwash. If you want to have more security then 1. have a look at the protocol / system and 2. possibly consider Post Quantum Cryptography, because even ECC 521 will not protect you from a full fledged Quantum Computer with Shor's algorithm. $\endgroup$– Maarten Bodewes ♦Commented Feb 26, 2018 at 19:21