Forum Discussion

Anonymous's avatar
Anonymous
4 years ago

Importing ssh key ecdsa-sha2-nistp521 reports unsupported key type

  • create new item of type SSH

  • click add key, and select key from my .ssh directory this key was generated using format
    ssh-keygen -t ecdsa -b 521 -C "keynameHere emailHere" -f ~/.ssh/mynewkeynamehere

  • 1password shows error message

  • cat the key and confirm it starts: "ecdsa-sha2-nistp521 "

Why can't I import this key please?

1Password Version: 8.7
Extension Version: Not Provided
OS Version: Not Provided

SSH

5 Replies

  • Anonymous's avatar
    Anonymous
    4 years ago

    floris_1P How long will this feature be released in the production channel?

  • floris_1P's avatar
    floris_1P
    Icon for 1Password Team rank1Password Team
    4 years ago

    We do have plans to support ECDSA for importing, but we will probably never support it for key generation.

  • Anonymous's avatar
    Anonymous
    4 years ago

    Would be nice if this could be supported in the future. I'm currently needing it for using GitHub in Xcode. ed25519 is not supported in Xcode. ecdsa is supported in Xcode. In the past I've used rsa, but it's not supported by GitHub anymore since a couple of weeks.

  • austin's avatar
    austin
    Frequent Contributor
    4 years ago

    Not Agilebits, but I found this on security.stackexchange https://security.stackexchange.com/questions/50878/ecdsa-vs-ecdh-vs-ed25519-vs-curve25519#50890. It looks like ed25519 may be more secure overall, so when they implemented this initial version they focussed on RSA (super common) and ed25519 (increasingly common but much more secure). Like SSH certificate support, they may simply have not considered ecdsa to be both common enough and secure enough to justify the engineering resources. Unlike regular DSA, I could see them implementing ecdsa.

  • Anonymous's avatar
    Anonymous
    4 years ago

    https://developer.1password.com/docs/ssh/agent/#eligible-keys

    "Generated or imported using the SSH Key item type (which supports Ed25519 or RSA key types)"

    That will be the problem. What's the problem with supporting ecdsa type?