Section 8.3
describes the typical process of configuring PuTTY to attempt public-key authentication, and configuring your SSH
server to accept it.
8.2.2 Selecting the type of key
Before generating a key pair using PuTTYgen, you need to select which type of key you need. PuTTYgen currently supports three types of key:
•An RSA key for use with the SSH-1 protocol.
•An RSA key for use with the SSH-2 protocol.
•A DSA key for use with the SSH-2 protocol.
The SSH-1 protocol only supports RSA keys; if you will be connecting using the SSH-1 protocol, you must select the first key type or your key will be completely useless.
The SSH-2 protocol supports more than one key type. The two types supported by PuTTY are RSA and DSA.
The PuTTY developers strongly recommend you use RSA. DSA has an intrinsic weakness which makes it very easy to create a signature which contains enough information to give away the private key! This would allow an attacker to pretend to be you for any number of future sessions. PuTTY's implementation has taken very careful precautions to avoid this weakness, but we cannot be 100% certain we have managed it, and if you have the choice we strongly recommend using RSA keys instead.
If you really need to connect to an SSH server which only supports DSA, then you probably have no choice but to use DSA. If you do use DSA, we recommend you do not use the same key to authenticate with more than one server.
8.2.3 Selecting the size (strength) of the key
The ‘Number of bits’ input box allows you to choose the strength of the key PuTTYgen will generate.
Currently 1024 bits should be sufficient for most purposes.
8.2.4 The ‘Generate’ button
Once you have chosen the type of key you want, and the strength of the key, press the ‘Generate’ button and PuTTYgen will begin the process of actually generating the key.
First, a progress bar will appear and PuTTYgen will ask you to move the mouse around to generate randomness. Wave the mouse in circles over the blank area in the PuTTYgen window, and the progress bar will gradually fill up as PuTTYgen collects enough randomness. You don't need to wave the mouse in particularly imaginative patterns (although it can't hurt); PuTTYgen will collect enough randomness just from the fine detail of exactly how far the mouse has moved each time Windows samples its position.
When the progress bar reaches the end, PuTTYgen will begin creating the key. The progress bar will reset to the start, and gradually move up again to track the progress of the key generation. It will not move evenly, and may occasionally slow down to a stop; this is unfortunately unavoidable, because key generation is a random process and it is impossible to reliably predict how long it will take.
When the key generation is complete, a new set of controls will appear in the window to indicate this.
8.2.5 The ‘Key fingerprint’ box
The ‘Key fingerprint’ box shows you a fingerprint value for the generated key. This is derived cryptographically from the public key value, so it doesn't need to be kept secret.
The fingerprint value is intended to be cryptographically secure, in the sense that it is computationally infeasible for someone to invent a second key with the same fingerprint, or to find a key with a particular fingerprint. So some utilities, such as the Pageant key list box (see
section 9.2.1
) and the Unix ssh-add utility, will list key fingerprints rather than the whole public key.
8.2.6 Setting a comment for your key