2

Is it possible to use ECDSA(Elliptic Curve Digital Signature Algorithm) or EdDSA( Edwards-curve Digital Signature Algorithm) instead of RSA when configuring SSH-CA on HashiCorp Vault?

3

I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both.

You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot sign using it. I haven't tried ed25519.

Golang's ssh code (which vault uses) doesn't appear to know how to sign with ed25519 but should be able to sign with ecdsa. However, I think there's an issue with an inappropriate default being set elsewhere that means it is always being told to use an rsa-based signing algorithm and hence doomed to fail for ecdsa keys. See:

https://github.com/hashicorp/vault/issues/8414#issuecomment-656145432

If I am right, it looks like an easy fix so it may be available soon.

| improve this answer | |
  • Yep, you're right, raised with Hashicorp Enterprise support, no answer yet. – Woodstock Jul 9 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.