SSH client certs with ed25519

[logopk]

Hi,

all step ssh certificates seem to be ecdsa.

The host key can be created using crypto --kty=OKP --curve=ed25519, but the step ssh certificate does not have these options.

Should this be possible, or is this missing? If so, are you planning to get the more secure ed25519 anytime soon?

Thanks

Peter

[maraino]

This should be possible, as a workaround you can create a certificate from a previously created key using the --sign flag:

# create private (ed) and public (ed.pub) keys
ssh-keygen -t ed25519 -f ed
# Sign ed.pub
step ssh certificate --sign [email protected] ed.pub

Or with step only:

# create keypair
step crypto keypair --kty OKP ed25519.pem ed25519.priv
# Convert public key to ssh format
step crypto key format --ssh --out ed25519.pub ed25519.pem
# Sign ed25519.pub
step ssh certificate --sign [email protected] ed25519.pub

You can do the same for hosts using for example the previously generated key in /etc/sshd and using --sign --host

[logopk]

Perfect. Thanks, that helps already.

[maraino]

I've added this new issue to track the feature in the cli smallstep/cli#477