Supported Key Types

ZestSSH supports the following SSH key types for both user authentication and host key verification.

User Keys (Authentication)

These are the key types you can generate or import in ZestSSH for authenticating to servers.

Ed25519 (Recommended)

Property	Value
Algorithm	EdDSA on Curve25519
SSH Name	`ssh-ed25519`
Key Size	256 bits (fixed)
Security Level	~128 bits

The recommended key type. Ed25519 keys are compact (68 bytes for the public key), fast to generate, and fast to sign. The algorithm is resistant to side-channel attacks by design.

Ed25519 is supported by OpenSSH 6.5+ and virtually all modern SSH servers.

Generate in ZestSSH: Identities > + > Generate Key > Ed25519

RSA

Property	Value
Algorithm	RSA (PKCS#1 v1.5 signature)
SSH Names	`ssh-rsa`, `rsa-sha2-256`, `rsa-sha2-512`
Key Sizes	2048, 4096 bits
Security Level	~112 bits (2048), ~140 bits (4096)

RSA keys are universally supported. ZestSSH generates RSA keys in a background isolate to avoid blocking the UI, as RSA-4096 key generation is CPU-intensive.

Signature algorithms: ZestSSH supports rsa-sha2-256 and rsa-sha2-512 (RFC 8332) in addition to the legacy ssh-rsa (SHA-1). Modern servers prefer rsa-sha2-256 or rsa-sha2-512.

Recommendation: Use 4096-bit RSA if you need RSA for compatibility. 2048-bit is the minimum acceptable size. Prefer Ed25519 when the server supports it.

Generate in ZestSSH: Identities > + > Generate Key > RSA 2048 or RSA 4096

ECDSA

Curve	SSH Name	Security Level
P-256 (secp256r1)	`ecdsa-sha2-nistp256`	~128 bits
P-384 (secp384r1)	`ecdsa-sha2-nistp384`	~192 bits
P-521 (secp521r1)	`ecdsa-sha2-nistp521`	~256 bits

ECDSA with NIST curves is supported for environments that require NIST-approved algorithms (FIPS compliance). Key generation runs in a background isolate.

Recommendation: Prefer Ed25519 unless NIST curves are specifically required by your organization.

Generate in ZestSSH: Identities > + > Generate Key > ECDSA P-256, P-384, or P-521

Host Keys (Server Verification)

ZestSSH verifies the following host key types presented by servers:

SSH Name	Algorithm
`ssh-ed25519`	Ed25519
`ssh-ed448`	Ed448
`ssh-rsa`	RSA with SHA-1 signature
`rsa-sha2-256`	RSA with SHA-256 signature
`rsa-sha2-512`	RSA with SHA-512 signature
`ecdsa-sha2-nistp256`	ECDSA P-256
`ecdsa-sha2-nistp384`	ECDSA P-384
`ecdsa-sha2-nistp521`	ECDSA P-521

Host Key Verification

On first connection to a server, ZestSSH stores the server’s host key fingerprint in its Known Hosts database. On subsequent connections, it verifies the key matches. If the key has changed, ZestSSH shows a warning --- this could indicate a server reinstallation or a man-in-the-middle attack.

Not Supported

DSA (ssh-dss)

DSA keys are not supported. DSA has been deprecated by OpenSSH since version 7.0 (2015) due to:

Fixed 1024-bit key size, providing only ~80 bits of security.
Catastrophic failure mode: reusing a nonce during signing reveals the private key.
Superseded by Ed25519 and ECDSA in every way.

If you have DSA keys, generate new Ed25519 keys and deploy them to your servers.

Key Import Formats

ZestSSH can import keys in the following formats:

Format	Extension	Supported
OpenSSH modern format	(no standard extension)	Yes
OpenSSH PEM (RSA PRIVATE KEY)	`.pem`	Yes
PKCS#8 PEM (PRIVATE KEY)	`.pem`	Yes
PuTTY PPK (v2, v3)	`.ppk`	Yes
SSH public key	`.pub`	Import as identity (public key only)

Encrypted Keys

ZestSSH can import passphrase-protected keys. When you select an encrypted key file, ZestSSH prompts for the passphrase. Supported encryption schemes include:

OpenSSH modern format encryption (AES-256-CTR with bcrypt KDF)
Old-style PEM encryption (AES-128-CBC, AES-256-CBC, 3DES-CBC with MD5 KDF)
PuTTY PPK encryption (Argon2id for PPKv3, SHA-1 for PPKv2)

Key Fingerprints

ZestSSH displays key fingerprints in the SHA-256 format:

SHA256:base64encodedHash

This matches the format used by ssh-keygen -l -E sha256 on OpenSSH.