Supported Key Types
ZestSSH supports the following SSH key types for both user authentication and host key verification.
User Keys (Authentication)
Section titled “User Keys (Authentication)”These are the key types you can generate or import in ZestSSH for authenticating to servers.
Ed25519 (Recommended)
Section titled “Ed25519 (Recommended)”| Property | Value |
|---|---|
| Algorithm | EdDSA on Curve25519 |
| SSH Name | ssh-ed25519 |
| Key Size | 256 bits (fixed) |
| Security Level | ~128 bits |
The recommended key type. Ed25519 keys are compact (68 bytes for the public key), fast to generate, and fast to sign. The algorithm is resistant to side-channel attacks by design.
Ed25519 is supported by OpenSSH 6.5+ and virtually all modern SSH servers.
Generate in ZestSSH: Identities > + > Generate Key > Ed25519
| Property | Value |
|---|---|
| Algorithm | RSA (PKCS#1 v1.5 signature) |
| SSH Names | ssh-rsa, rsa-sha2-256, rsa-sha2-512 |
| Key Sizes | 2048, 4096 bits |
| Security Level | ~112 bits (2048), ~140 bits (4096) |
RSA keys are universally supported. ZestSSH generates RSA keys in a background isolate to avoid blocking the UI, as RSA-4096 key generation is CPU-intensive.
Signature algorithms: ZestSSH supports rsa-sha2-256 and rsa-sha2-512 (RFC 8332) in addition to the legacy ssh-rsa (SHA-1). Modern servers prefer rsa-sha2-256 or rsa-sha2-512.
Recommendation: Use 4096-bit RSA if you need RSA for compatibility. 2048-bit is the minimum acceptable size. Prefer Ed25519 when the server supports it.
Generate in ZestSSH: Identities > + > Generate Key > RSA 2048 or RSA 4096
| Curve | SSH Name | Security Level |
|---|---|---|
| P-256 (secp256r1) | ecdsa-sha2-nistp256 | ~128 bits |
| P-384 (secp384r1) | ecdsa-sha2-nistp384 | ~192 bits |
| P-521 (secp521r1) | ecdsa-sha2-nistp521 | ~256 bits |
ECDSA with NIST curves is supported for environments that require NIST-approved algorithms (FIPS compliance). Key generation runs in a background isolate.
Recommendation: Prefer Ed25519 unless NIST curves are specifically required by your organization.
Generate in ZestSSH: Identities > + > Generate Key > ECDSA P-256, P-384, or P-521
Ed448 (Import only)
Section titled “Ed448 (Import only)”| Property | Value |
|---|---|
| Algorithm | EdDSA on Curve448 |
| SSH Name | ssh-ed448 |
| Security Level | ~224 bits |
The engine can import and authenticate with Ed448 keys, a higher-security Edwards-curve alternative to Ed25519. Ed448 is import only — ZestSSH does not generate Ed448 keys in-app. Import an existing ssh-ed448 key from OpenSSH format. Note that Ed448 is far less widely deployed than Ed25519; use it only when a server specifically requires it.
FIDO2 Security Keys (sk-)
Section titled “FIDO2 Security Keys (sk-)”| Curve | SSH Name |
|---|---|
| Ed25519 | [email protected] |
| ECDSA P-256 | [email protected] |
Hardware-backed FIDO2 credentials (for example YubiKey). These keys are created on the token itself (ssh-keygen -t ed25519-sk / ecdsa-sk), never in software, and are used through the operating system’s ssh-agent on desktop. See FIDO2 Hardware Keys.
Certificates
Section titled “Certificates”Any of the software key types above can carry an OpenSSH user certificate (*[email protected]), imported and attached in the Keys view. See OpenSSH Certificates.
Host Keys (Server Verification)
Section titled “Host Keys (Server Verification)”ZestSSH verifies the following host key types presented by servers. The first group is offered by default; ssh-rsa (SHA-1) is added only when Compatibility mode is enabled on the connection.
| SSH Name | Algorithm | Availability |
|---|---|---|
ssh-ed25519 | Ed25519 | Default |
rsa-sha2-512 | RSA with SHA-512 signature | Default |
rsa-sha2-256 | RSA with SHA-256 signature | Default |
ecdsa-sha2-nistp521 | ECDSA P-521 | Default |
ecdsa-sha2-nistp384 | ECDSA P-384 | Default |
ecdsa-sha2-nistp256 | ECDSA P-256 | Default |
ssh-rsa | RSA with SHA-1 signature (legacy) | Compatibility mode |
Ed448 (ssh-ed448) is implemented in the engine but is not offered as a host-key algorithm by default, so a server presenting only an Ed448 host key will not be verified.
Host Key Verification
Section titled “Host Key Verification”On first connection to a server, ZestSSH stores the server’s host key fingerprint in its Known Hosts database. On subsequent connections, it verifies the key matches. If the key has changed, ZestSSH shows a warning --- this could indicate a server reinstallation or a man-in-the-middle attack.
Not Supported
Section titled “Not Supported”DSA (ssh-dss)
Section titled “DSA (ssh-dss)”DSA keys are not supported. DSA has been deprecated by OpenSSH since version 7.0 (2015) due to:
- Fixed 1024-bit key size, providing only ~80 bits of security.
- Catastrophic failure mode: reusing a nonce during signing reveals the private key.
- Superseded by Ed25519 and ECDSA in every way.
If you have DSA keys, generate new Ed25519 keys and deploy them to your servers.
Key Import Formats
Section titled “Key Import Formats”ZestSSH can import keys in the following formats:
| Format | Extension | Supported |
|---|---|---|
| OpenSSH modern format | (no standard extension) | Yes |
| OpenSSH PEM (RSA PRIVATE KEY) | .pem | Yes |
| PKCS#8 PEM (PRIVATE KEY) | .pem | Yes |
| PuTTY PPK (v2, v3) | .ppk | Yes (unencrypted only) |
| SSH public key | .pub | Import as identity (public key only) |
Encrypted Keys
Section titled “Encrypted Keys”ZestSSH can import passphrase-protected keys. When you select an encrypted key file, ZestSSH prompts for the passphrase. Supported encryption schemes include:
- OpenSSH modern format encryption (AES-256-CTR with bcrypt KDF)
- Old-style PEM encryption (AES-128-CBC, AES-256-CBC with MD5 KDF)
Encrypted PuTTY
.ppkfiles are not supported. ZestSSH imports unencrypted PPK v2/v3 keys, but a passphrase-protected PPK must be decrypted first — open it in PuTTYgen and save it without a passphrase, or export it to OpenSSH format — before importing.
Key Fingerprints
Section titled “Key Fingerprints”ZestSSH displays key fingerprints in the SHA-256 format:
SHA256:base64encodedHashThis matches the format used by ssh-keygen -l -E sha256 on OpenSSH.