use ed25519 keys instead of rsa keys #362

timball · 2020-10-09T19:49:50Z

RSA keys are outdated. This PR updates the document to suggest using ed25519 which, at this time, defaults to a 16 round key deviation function. It may be useful to suggest more rounds for the KDF, but that's for a different PR.

--timball

Why:

This Change is to encourage people to use a more sound cryptographic algorithm to generate their ssh keys.

Currently, the docs recommend 'ssh-keygen' and the RSA algorithm with 4096 bit keys. This is better than the ssh-keygen default of 3072 bit keys. Also, this paper suggests that about 1 in thousand RSA moduli were not cryptographically sound. Last but not least, the RSA algorithm at 1024 bits (or less) is considered unsafe by NIST. We should not encourage the use of an old algorithm that is often used in an unsafe way.

This change proposes that Github recommend using the more modern, and safer, ed25519 key algorithm rather than RSA.

What's being changed:

The original ssh-keygen flags -t rsa -b 4096 specifying the use of the rsa algorithm with a key 4096 bits long are replaced with -t ed25519 which specifies using the ed25519 algorithm.

Check off the following:

All of the tests are passing.
I have reviewed my changes in staging.
For content changes, I have reviewed the localization checklist
For content changes, I have reviewed the Content style guide for GitHub Docs.

RSA keys are outdated. Even by using larger 4096 keys maybe it's best to move away from rsa keys altogether. This PR updates the document to suggest using ed25519 keys which, at this time, defaults to a 16 round key deviation function. It may be useful to suggest more rounds for the KDF but that's for a different PR. --timball

welcome · 2020-10-09T19:49:52Z

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

janiceilene · 2020-10-09T20:46:21Z

Thanks for opening a PR 👍 Please fill out the pull request template and we'll get this up for review!

timball · 2020-10-09T22:24:32Z

Thanks for opening a PR 👍 Please fill out the pull request template and we'll get this up for review!

Is the pull request template the same as filing a bug report? If not where do I find the template? Please and thank you.

https://github.com/github/docs/issues/new?assignees=&labels%5B%5D=content&template=improve-existing-docs.md&title=

--timball

janiceilene · 2020-10-09T22:41:29Z

👋 @timball The pull request template is the information in the original comment at the top of this pull request (the Why? and What's changed?). You can see all of the text in the pull-request.md. It helps us to triage and choose the right reviewer for each PR that's opened. Thanks!

timball · 2020-10-16T21:27:34Z

Thanks for opening a PR 👍 Please fill out the pull request template and we'll get this up for review!

Okay! filled it out and editted the request template!

--timball

janiceilene · 2020-10-23T21:17:33Z

Thanks @timball I'll get this triaged for review!

hubwriter · 2020-10-27T12:04:16Z

@timball - Many thanks. The change looks like a good one. I just want to run this by our security folks here at GitHub then I'll merge this. The same thing crops up elsewhere in the docs, so we'll get those changed too. Thanks again. 👍

ptoomey3 · 2020-10-27T14:37:44Z

The reason for the docs as they are is because, at least at the time they were last updated, having the default docs use ed25519 would have resulted in a non-trivial number of customers receiving an error message, since ed25519 was new enough that a reasonably large portion of our customers were not using an operating system crypto lib that supported them by default. Do we know the stats on that today? If there is still a long-tail of folks that can't use ed25519, I wouldn't be opposed to updating the defaults and adding a "if that doesn't work..use RSA 4096 like this ..." section.

ptoomey3 · 2020-10-27T14:45:53Z

Ha..I just checked the repo for docs before we open-sourced it and I had already dug around a bit and assessed that it was 👍 to update the docs to ed25519. The issue just hadn't gotten prioritized to make the actual docs change yet. 👍 from me.

...t/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent.md

hubwriter · 2020-10-28T09:59:24Z

I've raised an issue to get another couple of topics updated likewise: #876

hubwriter

@timball - Thanks. As you agreed to my suggested change (adding the fallback note), I've gone ahead and changed this PR accordingly so that it can be merged. Thanks again for raising this.

hubwriter · 2020-10-29T08:42:34Z

This PR is ready to merge.
We're currently not merging into this repo but we'll get this merged in a few days.

github-actions · 2020-11-03T11:23:22Z

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours.

Co-authored-by: Jacob Prall <prall.jacob@gmail.com>

* initial setup * remove update search index for now * major overhaul - links to console and new portal not changed * index page for mst * mst-multi-node * finish mst section content * convert forge links * General edits for wording, etc. (github#381) * update (github#386) * Add command to install timescaledb-tools (github#364) * Fix missing semi-colon (github#363) Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Remove 'repeatable' isolation level from multinode docs (github#361) Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Fix bad path (github#360) * add leading slash * Add version * typo Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Update install instructions (github#359) * Update install instructions * Change postgres to timescaledb repo * Add sudo * Remove extra whitespace * Update to correct key * Edits per feedback * Add step to install postgres repo * Apply suggestions from code review Co-authored-by: Cam Hutchison <35285934+camscale@users.noreply.github.com> Co-authored-by: Cam Hutchison <35285934+camscale@users.noreply.github.com> Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Fix/link checker error (github#370) * add absolute path to links * add slash * Fix incorrect sql query (github#362) Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Add the toolkit as a pre-req to the tutorial. (github#306) * Add the toolkit as a pre-req to the tutorial. * Fix link in admon * Point to correct URL * fix link Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Fix/link checker error (github#374) * add absolute path to links * add slash * add base url * add new to ignore * Fix/link checker error (github#376) * add absolute path to links * add slash * add base url * add new to ignore * add scheme * Document the differences between time_bucket() and time_bucket_ng() (github#354) Document the differences between time_bucket() and time_bucket_ng() Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update install instructions (github#379) * Update install instructions * Update timescaledb/how-to-guides/install-timescaledb/installation-apt-debian.md Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Add metadata for tutorials (github#380) * Add metadata for tutorials * Update page-index.js typo correction Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * Update page-index.js Co-authored-by: Lana Brindley <github@lanabrindley.com> Co-authored-by: Cam Hutchison <35285934+camscale@users.noreply.github.com> Co-authored-by: Aleksander Alekseev <mail@eax.me> * change to cloud * cloud * Update time_bucket_ng.md (github#417) * Update cloud/cloud-multi-node.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update cloud/create-a-service.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update mst/create-a-service.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update timescaledb/tutorials/setting-up-mst-for-prometheus.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update timescaledb/tutorials/setting-up-mst-for-prometheus.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update timescaledb/tutorials/setting-up-mst-for-prometheus.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update timescaledb/tutorials/setting-up-mst-for-prometheus.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update timescaledb/tutorials/setting-up-mst-for-prometheus.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update cloud/create-a-service.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update time_bucket_ng.md * Update cloud/create-a-service.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * update portal managed * Feature/timescale license comparison (github#453) * added timescale license comparison * edit title * update * Make sure window functions are listed as unsupported (github#393) Co-authored-by: Jacob Prall <prall.jacob@gmail.com> * update link (github#420) * update (github#422) * Fix/update link checker (github#424) * update * don't check if starts with / * add excludes (github#426) * Fix/linkchecker (github#428) * add excludes * update * Fix/linkchecker (github#430) * add excludes * update * update * Fix/linkchecker (github#432) * add excludes * update * update * comment out link checker * Fix/link checker again (github#433) * try to include link checker * reinstate index rebuild on merge * tweak yaml * remove link detector * tweak curl * remove link checker * remove search index from deploy * tweak update search * update search index * change name of action * stop search index for now * ignore search update * remove update search index * Add .NET C# quick start tutorial (github#412) * Add C# dotnet quickstart * Update dotnet.md Fixing steps to have numbers, a few heading formatting issues, and changing the "step" text above each method. * Apply suggestions from code review Applying most changes. I want to verify that auto numbering will work across code sections before accepting those. Co-authored-by: Lana Brindley <github@lanabrindley.com> * Apply suggestions from code review Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update dotnet.md Co-authored-by: Ryan Booz <ryan@timescale.com> Co-authored-by: Lana Brindley <github@lanabrindley.com> * update copy * update copy * add edition * Fix typo in JSON docs (github#441) Co-authored-by: Tadas Malinauskas <tadas.malinauskas@oxylabs.io> * Clarify behavior when deleting a data node (github#406) * Clarify behavior when deleting a data node When deleting a data node, the database (including its data) on the data node is left intact. This sometimes confuses users and this change clarifies this behavior and adds explanations for why this behavior exists. * Update api/delete_data_node.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update api/delete_data_node.md Co-authored-by: Lana Brindley <github@lanabrindley.com> * Apply suggestions from code review minor copy edits Co-authored-by: Lana Brindley <github@lanabrindley.com> Co-authored-by: Jacob Prall <prall.jacob@gmail.com> Co-authored-by: Lana Brindley <github@lanabrindley.com> * Update README.md add newLabel to page-index read me * Add link to developer docs on GH (github#438) * Add link to developer docs on GH * Add link to developer docs on install page * remove new item Co-authored-by: Lana Brindley <github@lanabrindley.com> Co-authored-by: Jônatas Davi Paganini <jonatasdp@gmail.com> Co-authored-by: Ryan Booz <ryan@timescale.com> Co-authored-by: Tadas Malinauskas <Taadas@users.noreply.github.com> Co-authored-by: Tadas Malinauskas <tadas.malinauskas@oxylabs.io> Co-authored-by: Erik Nordström <819732+erimatnor@users.noreply.github.com> * Update timescaledb-license-comparison.md * update timescale table * add terms of service links * update * add terms of service links * Update timescaledb-license-comparison.md * Update timescaledb-license-comparison.md Co-authored-by: Lana Brindley <github@lanabrindley.com> Co-authored-by: Cam Hutchison <35285934+camscale@users.noreply.github.com> Co-authored-by: Aleksander Alekseev <mail@eax.me> Co-authored-by: Jônatas Davi Paganini <jonatasdp@gmail.com> Co-authored-by: Ryan Booz <ryan@timescale.com> Co-authored-by: Tadas Malinauskas <Taadas@users.noreply.github.com> Co-authored-by: Tadas Malinauskas <tadas.malinauskas@oxylabs.io> Co-authored-by: Erik Nordström <819732+erimatnor@users.noreply.github.com>

Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com>

janiceilene added content This issue or pull request belongs to the Docs Content team core labels Oct 23, 2020

janiceilene added the hacktoberfest-accepted We might not merge this PR before Nov 1st, but it's a wonderful Hacktoberfest contribution! label Oct 27, 2020

hubwriter reviewed Oct 28, 2020

View reviewed changes

...t/github/authenticating-to-github/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent.md Show resolved Hide resolved

hubwriter mentioned this pull request Oct 28, 2020

Change SSH key generation instructions to use the Ed25519 algorithm #876

Closed

10 tasks

hubwriter added 2 commits October 29, 2020 08:14

Add RSA fallback and change id_rsa to id_ed25519

519b8bb

Merge branch 'main' into patch-1

67648ea

hubwriter approved these changes Oct 29, 2020

View reviewed changes

hubwriter self-assigned this Oct 29, 2020

keremgocen mentioned this pull request Oct 30, 2020

Change SSH key generation instructions to use the Ed25519 algorithm #940

Merged

4 tasks

hubwriter added 2 commits November 3, 2020 11:00

Merge branch 'main' into patch-1

3663e55

Merge branch 'main' into patch-1

7882ce2

hubwriter merged commit 079c229 into github:main Nov 3, 2020

brockneedscoffee mentioned this pull request Nov 4, 2020

Update adding-a-new-ssh-key-to-your-github-account.md #1063

Merged

4 tasks

ramsemune mentioned this pull request Jun 23, 2022

[Snyk] Security upgrade linkinator from 2.13.4 to 3.0.0 ramsemune/docs#246

Open

jnidzwetzki pushed a commit to jnidzwetzki/docs that referenced this pull request Oct 6, 2022

Fix incorrect sql query (github#362)

4db406f

Co-authored-by: Jacob Prall <prall.jacob@gmail.com>

docs-bot added a commit that referenced this pull request Oct 9, 2024

[Early access companion] PR #362 (#52545)

ea2ec94

Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

use ed25519 keys instead of rsa keys #362

use ed25519 keys instead of rsa keys #362

timball commented Oct 9, 2020 •

edited

Loading

welcome bot commented Oct 9, 2020

janiceilene commented Oct 9, 2020

timball commented Oct 9, 2020

janiceilene commented Oct 9, 2020

timball commented Oct 16, 2020

janiceilene commented Oct 23, 2020

hubwriter commented Oct 27, 2020

ptoomey3 commented Oct 27, 2020

ptoomey3 commented Oct 27, 2020 •

edited

Loading

hubwriter commented Oct 28, 2020

hubwriter left a comment

hubwriter commented Oct 29, 2020

github-actions bot commented Nov 3, 2020

use ed25519 keys instead of rsa keys #362

use ed25519 keys instead of rsa keys #362

Conversation

timball commented Oct 9, 2020 • edited Loading

Why:

What's being changed:

Check off the following:

welcome bot commented Oct 9, 2020

janiceilene commented Oct 9, 2020

timball commented Oct 9, 2020

janiceilene commented Oct 9, 2020

timball commented Oct 16, 2020

janiceilene commented Oct 23, 2020

hubwriter commented Oct 27, 2020

ptoomey3 commented Oct 27, 2020

ptoomey3 commented Oct 27, 2020 • edited Loading

hubwriter commented Oct 28, 2020

hubwriter left a comment

Choose a reason for hiding this comment

hubwriter commented Oct 29, 2020

github-actions bot commented Nov 3, 2020

timball commented Oct 9, 2020 •

edited

Loading

ptoomey3 commented Oct 27, 2020 •

edited

Loading