dropbearkey: make rsa as a default value for -t #268
Conversation
|
I'm not keen on this - most Dropbear targets would be better off with ed25519 |
|
I checked and it turned out that the OpenSSH just recently switched to the ed25519 by default openssh/openssh-portable@e1c284d On my Ubuntu it still generates rsa but on the OpenWrt it already ahve a newer version. |
|
Given it can vary depending on compile options I think it's better to leave it with no default. The manage or help text could have a recommendation maybe.
|
|
Thinking a bit more, I guess a The preference order would probably be:
(different to the sigalgs list because negotiated hostkeys have fallbacks for compatibility, whereas a generated authkey doesn't, so RSA needs to be higher) |
The OpenSSH ssh-keygen allows to omit the -t and will use ed25519 by default. Previously it used RSA by default. For a better compatibility and simplification do the same. Since any algorithm can be disabled we should make a default with a better enabled option.
|
The PR is ready to be merged. I removed the check for the empty -t because now this will never happen. If none of the algo is enabled then the build will be failed by a check. So we are safe here. This is nice because this makes a binary smaller which is almost never happens when adding a new feature. |
|
Thanks |
The OpenSSH ssh-keygen allows to omit the -t and will use rsa by default. For a better compatibility and simplification do the same.