SSH Keys: Choosing RSA or Ed25519

SSH, or Secure Shell, keys play a critical role in modern authentication and encryption when establishing secure connections. By using public-key cryptography, SSH keys ensure that only permitted and trusted users can access remote resources. There are two main choices of algorithm for SSH keys today: RSA and Ed25519.

In this post we compare the two key types and look at the advantages and trade-offs of each, to help you make an informed choice.

Benefits of RSA SSH Keys

RSA, named after its creators Rivest, Shamir and Adleman, was publicly developed in 1977 and remains one of the most common and long-standing algorithms in cryptography and SSH authentication.

Some of the key features of RSA SSH keys include:

Widely Adopted

RSA keys are supported across the vast majority of SSH servers and clients, making them a great choice where compatibility and interoperability are crucial. RSA keys are widely compatible even with older systems that don’t support newer algorithms.

Strong Security

As standard, RSA uses 2048-bit key lengths to ensure a high level of security by default, with the option to increase this to 4096-bit for extra security margin on higher-risk connections.

Maturity

With decades of history and widespread use, RSA has been subject to extensive scrutiny and stress testing. It has reached a high level of maturity and holds the confidence of a huge range of industries and security standards.

Benefits of Ed25519 SSH Keys

Ed25519 is a newer algorithm than RSA, published in 2011, and has gained popularity for its security and efficiency. There are a number of reasons to consider it:

Strong Security with Smaller Key Sizes

Ed25519 uses elliptic curve cryptography to derive a key that offers strong security while being several times smaller than an equivalent RSA key. A 256-bit Ed25519 key offers security roughly comparable to a 3072-bit RSA key – a smaller RSA key than the 4096-bit option, but still a meaningfully higher security margin than RSA’s 2048-bit default.

Faster Key Generation and Authentication

Ed25519 keys are faster to generate and use less computational overhead during authentication. This is advantageous for both server performance and end-user experience.

A Simpler Implementation

Ed25519’s design leaves less room for implementation mistakes than RSA’s – there are no key-quality checks to get wrong and no dependency on a high-quality random number generator for every signature, both of which have caused real-world RSA vulnerabilities in poorly implemented software in the past.

Differences Between RSA and Ed25519 SSH Keys

To make the right choice for your use case, it’s worth understanding a few key differences between the two.

Key Length

To reach a comparable level of security, RSA requires significantly longer keys than Ed25519 – 2048 bits or more, versus Ed25519’s fixed 256 bits. Shorter keys mean less computing overhead to generate and verify, and a much smaller public key to store and copy around.

Security

Both RSA and Ed25519 deliver a strong standard of security when correctly configured – with today’s computing power, a properly sized key of either type is not feasible to brute-force. Neither algorithm offers any protection against a future large-scale quantum computer; that requires a dedicated post-quantum algorithm, which is a separate consideration from choosing between RSA and Ed25519 today.

Speed and Efficiency

Ed25519’s smaller key size and simpler maths make signing and verification noticeably faster than RSA, which gives it the edge in high-connection-volume situations such as automated deployment pipelines.

Making the choice

The choice between RSA and Ed25519 SSH keys mostly comes down to two questions:

Do you need compatibility with older or legacy systems that might not support Ed25519? If so, go with RSA.

Are you working with modern systems and want smaller keys and faster authentication? Then Ed25519 is the better default choice.

Both give you a genuinely secure connection to your server. Ed25519 is the newer, faster, and generally recommended default for anything that supports it; RSA remains the safer choice specifically where you need to guarantee compatibility with older or third-party systems.