Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I used ssh-keygen -t ecdsa to generate an ECDSA key, but I got the error unknown key type ecdsa.

man ssh-keygen says:

 -t type
         Specifies the type of key to create.  The possible values are ``rsa1''
         for protocol version 1 and ``dsa'', ``ecdsa'' or ``rsa'' for
         protocol version 2.

Does anyone have any insight on this?

share|improve this question
    
Is /usr/bin/ssh-keygen the only version of this on your system and do you have maybe multiple OpenSSL versions? My 10.8.2 system has ssh -V OpenSSH_5.9p1, OpenSSL 0.9.8r 8 Feb 2011. –  MacLemon Jan 14 '13 at 4:12
add comment

2 Answers 2

up vote 11 down vote accepted

The manpage describes the ability to generate ECC keys because the version of OpenSSH 5.9p1 (the version that comes with Mountain Lion) can potentially support ECC. However, the actual build of OpenSSH that came bundled with Mountain Lion appears to lack ECC support1. The manpages are not modified when ECC support is not included in the compiled binaries.

If you want or need ECC support, you could use MacPorts (or probably Homebrew) to install a build of OpenSSH that does support ECC. You might run into some incompatibilities though:

  • the bundled ssh-agent (started automatically by launchd) will not be able to handle any ECC keys (you would have to start your own instance of the “custom”-built agent, or type your password each time you use an ECC key with the “custom”-built ssh), and
  • the “custom”-built tools will not have Apple’s patched-in Keychain integration.

1 OpenSSH’s configure script does some checks to make sure that the available OpenSSL library is new enough and includes various bits of ECC functionality; the bundled version of OpenSSL seems to satisfy these requirements. I am not sure why the bundled version of OpenSSH was built without ECC support.

share|improve this answer
add comment

There are potential patent issues with Elliptic Curve crypto so a lot of vendors chicken out on supporting it for now. It appears to be available in the OSX OpenSSL installation, though, so you'll just need to compile OpenSSH on your own.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.