SSH Key Types Compared: Ed25519, RSA, ECDSA, or DSA?
Not all SSH key types are equal. Learn the differences between Ed25519, RSA, ECDSA, and DSA to choose the right key for maximum security and compatibility.
When generating SSH keys, you're presented with a choice of algorithms: Ed25519, RSA, ECDSA, or DSA. Most people stick with the default (RSA) without understanding the trade-offs. But the choice matters for security, performance, and compatibility.
This guide compares all four SSH key types to help you make an informed decision.
Quick Recommendation
Use Ed25519 for new keys. It's the most secure, fastest, and smallest key type. Only use RSA if you need compatibility with very old systems.
ssh-keygen -t ed25519 -C "your_email@example.com"
Now let's understand why.
The Four Key Types
1. Ed25519 (Recommended)
Ed25519 uses elliptic curve cryptography based on Curve25519.
Key size: 256 bits (public key is 68 characters)
Generate:
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
Advantages:
- Fastest: Both key generation and signing are extremely fast
- Smallest: Shortest keys and signatures
- Most secure: Resistant to side-channel attacks
- Simple: No configuration options to get wrong
- Modern: Designed in 2011 with modern cryptographic standards
Disadvantages:
- Compatibility: Not supported by very old SSH implementations (pre-2014)
- Fixed size: Can't increase key length for future-proofing (though 256-bit Ed25519 is considered secure for decades)
Support:
- OpenSSH 6.5+ (January 2014)
- All modern operating systems
- FoxTerm: Full support
2. RSA (Legacy Default)
RSA is the oldest widely-used SSH key algorithm.
Key size: 2048-4096 bits (recommended minimum: 3072)
Generate:
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa
Advantages:
- Universal compatibility: Works with every SSH implementation ever made
- Well understood: Decades of cryptanalysis and real-world use
- Configurable: Can increase key size for theoretical future-proofing
Disadvantages:
- Slowest: Key generation and signing are computationally expensive
- Largest: 4096-bit keys are 742 characters long
- Less secure per bit: Requires much larger keys for equivalent security
- Vulnerable to quantum computers: Like all current public-key crypto, but RSA is most affected
Security note: 1024-bit RSA is considered broken. Use 3072-bit minimum, preferably 4096.
Support:
- Every SSH client/server ever made
- FoxTerm: Full support
3. ECDSA (Elliptic Curve DSA)
ECDSA uses elliptic curve cryptography with NIST curves.
Key size: 256, 384, or 521 bits
Generate:
ssh-keygen -t ecdsa -b 256 -f ~/.ssh/id_ecdsa
Advantages:
- Smaller than RSA: Equivalent security with much smaller keys
- Faster than RSA: Better performance for signing operations
- Standardized: NIST curves are widely studied
Disadvantages:
- Complexity: Implementation complexity has led to vulnerabilities
- NIST curves: Some concern about potential NSA influence on curve selection
- Variable quality: Security depends on random number generator quality
- Slower than Ed25519: Ed25519 outperforms ECDSA in every metric
Support:
- OpenSSH 5.7+ (2011)
- Most modern systems
- FoxTerm: Full support
4. DSA (Deprecated)
DSA is an older algorithm that is now deprecated.
Key size: Fixed at 1024 bits
Generate:
ssh-keygen -t dsa -f ~/.ssh/id_dsa
Advantages:
- None in 2025
Disadvantages:
- Fixed key size: 1024 bits is considered insecure
- Deprecated: Removed from OpenSSH 7.0+ (2015)
- Slow: Worse performance than both RSA and ECDSA
- Vulnerable: Susceptible to poor random number generation
Never use DSA for new keys. If you have existing DSA keys, replace them immediately.
Security Comparison
Equivalent Security Levels
| Algorithm | Key Size | Security Level | Quantum Resistant |
|---|---|---|---|
| Ed25519 | 256 bit | ~128 bit | No |
| ECDSA | 256 bit | ~128 bit | No |
| RSA | 3072 bit | ~128 bit | No |
| RSA | 4096 bit | ~156 bit | No |
| DSA | 1024 bit | ~80 bit | No |
Note: None of these are resistant to large-scale quantum computers. Post-quantum SSH is still experimental.
Attack Resistance
Side-channel attacks: Ed25519 > ECDSA > RSA > DSA
Ed25519 was designed to be constant-time, making it resistant to timing attacks.
Implementation flaws: Ed25519 > RSA > ECDSA > DSA
Simpler algorithms have fewer opportunities for implementation errors.
Random number quality: Ed25519 > RSA > ECDSA > DSA
Ed25519 is more forgiving of imperfect randomness.
Performance Benchmarks
Key generation time (average on M2 MacBook):
Ed25519: 0.001 seconds
ECDSA: 0.003 seconds
RSA 2048: 0.1 seconds
RSA 4096: 0.8 seconds
DSA: 0.05 seconds
Signing operations per second:
Ed25519: ~50,000 ops/sec
ECDSA: ~20,000 ops/sec
RSA 2048: ~2,000 ops/sec
RSA 4096: ~500 ops/sec
Ed25519 is dramatically faster for both key generation and authentication.
Compatibility Matrix
| Client \ Server | Ed25519 | RSA | ECDSA | DSA |
|---|---|---|---|---|
| OpenSSH 9.x | ✅ | ✅ | ✅ | ❌ |
| OpenSSH 7.x | ✅ | ✅ | ✅ | ❌ |
| OpenSSH 6.5 | ✅ | ✅ | ✅ | ✅ |
| OpenSSH 5.x | ❌ | ✅ | ✅ | ✅ |
| PuTTY | ✅* | ✅ | ✅ | ✅ |
| Dropbear | ✅* | ✅ | ❌ | ❌ |
| libssh | ✅ | ✅ | ✅ | ✅ |
*Recent versions only
Rule of thumb: If your servers run OpenSSH 6.5+ (released 2014), Ed25519 works fine. For anything older, use RSA 4096.
Migration Guide: Replace Old Keys
Step 1: Generate New Ed25519 Key
ssh-keygen -t ed25519 -C "your_email@example.com" -f ~/.ssh/id_ed25519
Step 2: Add to SSH Agent
ssh-add ~/.ssh/id_ed25519
Step 3: Copy to Servers
ssh-copy-id -i ~/.ssh/id_ed25519 user@server
Or manually append to ~/.ssh/authorized_keys on each server.
Step 4: Test Connection
ssh -i ~/.ssh/id_ed25519 user@server
Step 5: Update SSH Config
# ~/.ssh/config
Host *
IdentityFile ~/.ssh/id_ed25519
# Keep old key as fallback during transition
IdentityFile ~/.ssh/id_rsa
Step 6: Remove Old Keys
Once confident all servers accept the new key:
rm ~/.ssh/id_rsa ~/.ssh/id_rsa.pub
Keep backups until you've verified everything works.
Multiple Keys Strategy
For complex environments, maintain multiple keys:
# Personal Ed25519 key
ssh-keygen -t ed25519 -C "personal@email.com" -f ~/.ssh/id_personal
# Work RSA key (for legacy systems)
ssh-keygen -t rsa -b 4096 -C "work@company.com" -f ~/.ssh/id_work
# Deployment key (restricted, no passphrase)
ssh-keygen -t ed25519 -C "deploy@production" -f ~/.ssh/id_deploy -N ""
Configure per-host:
# ~/.ssh/config
Host github.com
IdentityFile ~/.ssh/id_personal
Host *.company.com
IdentityFile ~/.ssh/id_work
Host production-*
IdentityFile ~/.ssh/id_deploy
Key Passphrases
Always protect keys with passphrases:
ssh-keygen -t ed25519 -C "email@example.com"
# Prompts for passphrase
Benefits:
- Protects key if file is stolen
- Adds encryption layer (AES-256 by default)
- Minimal inconvenience with ssh-agent
Use ssh-agent to avoid retyping:
# macOS: Keychain integration
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
# Linux: Start agent
eval $(ssh-agent -s)
ssh-add ~/.ssh/id_ed25519
FoxTerm Key Management
FoxTerm simplifies SSH key management:
Generate Keys
Settings → SSH Keys → "Generate New Key":
- Choose algorithm (Ed25519 recommended)
- Set optional passphrase
- Key is stored in Secure Enclave (macOS/iOS)
Import Existing Keys
Drag and drop private key files into FoxTerm, or use "Import Key" button.
Secure Storage
On macOS and iOS, FoxTerm stores keys in the Secure Enclave, hardware-isolated from the main processor. Even if your device is compromised, keys remain protected.
Auto-Selection
FoxTerm automatically selects the appropriate key based on server compatibility and your SSH config.
Conclusion
For new SSH keys in 2025, Ed25519 is the clear winner: faster, smaller, more secure, and well-supported. RSA remains necessary for legacy compatibility. ECDSA is acceptable but offers no advantage over Ed25519. DSA should never be used.
Generate your Ed25519 key today and retire those old RSA keys.
FoxTerm manages SSH keys securely with Secure Enclave support. Download at foxterm.app.