I don't think there is any point to generate so many moduli. Actually, 3 moduli of sizes 2048, 3072 and 4096 seem like a sane choice. On Fri, Feb 15, 2019 at 7:58 AM Darren Tucker <dtucker@xxxxxxxxxxx> wrote: > > On Fri, 15 Feb 2019 at 14:22, Yegor Ievlev <koops1997@xxxxxxxxx> wrote: > > I'm not nearly knowledgeable enough in crypto to fully understand your > > answer, but I will try. I wonder why moduli are not automatically > > generated the first time sshd is started though. That would make much > > more sense than shipping a default moduli file but also asking > > everyone to replace it with their own. > > That was the original intent (and it's mentioned in RFC4419) however > each moduli file we ship (70-80 instances of 6 sizes) takes about 1 > cpu-month to generate on a lowish-power x86-64 machine. Most of it is > parallelizable, but even then it'd likely take a few hours to generate > one of each size. I imagine that'd cause some complaints about > startup time. > > With those caveats, you are also welcome to add the appropriate > ssh-keygen commands to your startup scripts. > > -- > Darren Tucker (dtucker at dtucker.net) > GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860 37F4 9357 ECEF 11EA A6FA (new) > Good judgement comes with experience. Unfortunately, the experience > usually comes from bad judgement. _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
