Originally published on eve.gd on 22 July 2011, last updated 6 September 2026.
Read this post on the web (with images, PDF and citation details)
Having read two great posts on OpenSSH best practices, I decided today that I wanted to upgrade my SSH key architecture to use Elliptical Curve Cryptography. There were several gotchas involved that I thought it would be worth sharing here. There are, at the time of writing, no packages for Fedora 15 or Debian stable that I could find, so I've worked from source.
two great posts
OpenSSH best practices
Elliptical Curve Cryptography
Getting ECC working on some systems can be a bit of a pain. Fedora, in particular, has decided, due to patent encumbrance, to remove the header include files for OpenSSL's ECC implementation. To get around this, I therefore recommend reinstalling OpenSSL from source from their site. You will be able to tell whether your distro will have this problem because, in the ./configure output of OpenSSH you will encounter:
reinstalling OpenSSL from source
checking whether OpenSSL has complete ECC support... no
An easy way to check is to look for the presence of /usr/include/openssl/ecdsa.h
So, once you've got the latest and greatest OpenSSL installed, download the latest OpenSSH portable tar.gz. Then, you'll want to run the following.
On Fedora 15 (after installing OpenSSL from source; last command in this list needs to be root):
tar -xzf openssh-5.8p2.tar.gz cd openssh-5.8p2 ./configure --with-selinux --bindir=/usr/bin --sbindir=/usr/sbin --with-ssl-dir=/usr/local/ssl/ make make install
On Debian/Ubuntu (not necessary to install OpenSSL from source):
tar -xzf openssh-5.8p2.tar.gz cd openssh-5.8p2 ./configure --bindir=/usr/bin --sbindir=/usr/sbin make sudo make install
You can then use the setup as expected.
ssh-keygen -t ecdsa -b 521 ssh-copy-id -i ~/.ssh/id_ecdsa.pub user@server.tld
Featured image by Koen Photos under a CC-BY-ND license.
This reference list has been generated, in many cases, through an automated process and may therefore contain errors or incomplete metadata. It is provided purely as assistance for finding the items mentioned within this post.
1. ‘Downloads’, OpenSSL <http://www.openssl.org/source/>
2. ‘Good practices for using ssh’ <http://lackof.org/taggart/hacking/ssh/>
3. Koen, Koen, Flickr <http://www.flickr.com/photos/koen_photos/>
http://www.openssl.org/source/
http://lackof.org/taggart/hacking/ssh/
http://www.flickr.com/photos/koen_photos/