Re: FYI: ssh-keygen now takes several hours on mac68k (for 2048-bit keys)

Andrew Daugherity wrote:
> Yes, it's mentioned in FAQ 4.12.3 that this step may take a while ("A
> SPARCStation2 or a Macintosh Quadra may take 45 minutes or more to
> complete the three ssh-keygen(1) steps, some machines will take even
> longer."), but with the recent change (which will be in 3.8) to use
> 2048-bit keys by default (instead of 1024), ssh-keygen now takes much
> longer to run.

Yes, this is already in the updates to the FAQ which will be released
with 3.8...  Not that I really expect someone who has been using OpenBSD
for a few years to suddenly dive back to the FAQ when "My machine
booted, but hung at the ssh-keygen steps!", but it will be there if
people care. :)

> On my Quadra 605 with a 25MHz 68040 and 36MB RAM, generating a
> 1024-bit DSA key takes around 10 minutes.  A 2048-bit DSA key takes
> 252 minutes!  The RSA keys don't take nearly as long (10 min for
> 2048-bit, 1:15 for 1024-bit), but the default configuration expects
> all three types of keys, so you should generate all three.
> 
> Thus, unless you feel like waiting several hours for your installation
> to finish its initial boot, I recommend doing one of the following:
> 
> * Generate the keys on a faster machine and copy them into /etc/ssh/
> on your mac68k box.  The appropriate syntax is in /etc/rc, grep for
> "ssh-keygen"; change the output directory so you don't clobber the
> host keys on that system.  Note that on 3.7 and earlier, 1024-bit keys
> are generated by default, so you may want to add a "-b 2048" parameter
> if you really want 2048-bit keys.

"and drop them in a site38.tgz file so they can be installed with the
rest of the file sets" :)

> * Manually generate 1024-bit keys: Boot the box in single-user mode
> after install, mount your partitions rw, and manually invoke
> ssh-keygen with the same parameters as in /etc/rc, except adding "-b
> 1024".  If you do this, be willing to accept the security tradeoffs of
> using shorter keys.

or ...

* walk away, do something else while the keygen is taking place.

This is the way I usually end up using during a LOT of Mac68k install
steps.  It usually takes me two or three days to bring up a new mac68k
machine, because there are so many steps where I wander off to do
something else. :)

Yes, this key size change is painful for users of slow computers.  If
you have been watching, this has been a "suggestion" by a lot of people
  (with wickedly fast computers) for a long time, and it has been
resisted for a long time for just the reasons you mention.  This
decision was not taken lightly...

Nick.