I feel like the Dual_EC_DRBG backdoor has given Elliptic Curve Crypto a bad reputation lasting for decades. I guess it's unfair to the technology as a whole, but somehow RSA just feels safe and battle tested.
https://www.libssh.org/2013/11/03/openssh-introduces-curve25...
"This algorithm does not rely on NIST-based curves and gives us more security confidence against a possible backdoor in nistp-256 curve. Today is a big day for us because OpenSSH team approved my patch and made curve25519-sha256@libssh.org the default key exchange!"
Also, the original RSA keys used in SSH have a sha-1 problem, and have been deprecated.
https://www.zdnet.com/article/openssh-to-deprecate-sha-1-log...
https://www.openssh.com/releasenotes.html
This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]
For most users, this change should be invisible and there is
no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
will automatically use the stronger algorithm where possible.
Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol.Furthermore:
> Also, the original RSA keys used in SSH have a sha-1 problem, and have been deprecated.
This is wrong. What's correct is that openssh plans to deprecate sha1 signatures, but you can still use your RSA keys with sha2-based signatures.
Kinda strange people are moving on to EC cipher - which is good, but to the cipher which has the NIST/NSA smell.
http://blog.cr.yp.to/20140323-ecdsa.html
"To be fair I should mention that there's one standard NIST curve using a nice prime, namely 2^521 - 1; but the sheer size of this prime makes it much slower than NIST P-256."