Answers: <p>I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both.</p>
  <p>You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot sign using it. I haven't tried ed25519.</p>
  <p>Golang's ssh code (which vault uses) doesn't appear to know how to sign with ed25519 but should be able to sign with ecdsa. However, I think there's an issue with an inappropriate default being set elsewhere that means it is always being told to use an rsa-based signing algorithm and hence doomed to fail for ecdsa keys. See:</p>
  <p><a href="https://github.com/hashicorp/vault/issues/8414#issuecomment-656145432" rel="nofollow noreferrer">https://github.com/hashicorp/vault/issues/8414#issuecomment-656145432</a></p>
  <p>If I am right, it looks like an easy fix so it may be available soon.</p>
  <p>This is possible as of August 2020, see <a href="https://github.com/hashicorp/vault/pull/9824" rel="nofollow noreferrer">https://github.com/hashicorp/vault/pull/9824</a>, tested with vault 1.6.2</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-07-09T16:18:37.217Z
Answers: Yep, you're right, raised with Hashicorp Enterprise support, no answer yet.
Answers: Woodstock
Answers: CC BY-SA 4.0
Answers: 2020-07-09T15:41:44.170Z
Answers: 2021-02-17T06:34:13.140Z
Answers: 2021-02-17T06:34:13.140Z
Answers: Jon Diprose
Body: <p>Is it possible to use <code>ECDSA</code>(<a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow noreferrer">Elliptic Curve Digital Signature Algorithm</a>) or <code>EdDSA</code>(<a href="https://en.wikipedia.org/wiki/EdDSA" rel="nofollow noreferrer"> Edwards-curve Digital Signature Algorithm</a>) instead of <code>RSA</code> when configuring <code>SSH-CA</code> on <code>HashiCorp Vault</code>?</p>
  
Tags: <hashicorp-vault><encryption><ssh>
Title: Vault `SSH-CA` Elliptic Curve rather than `RSA`
UserDisplayName: Woodstock
ThreadText: # Vault `SSH-CA` Elliptic Curve rather than `RSA`
  
  (Asked by: username_0 on 2020-04-28)
  
  Is it possible to use `ECDSA`([Elliptic Curve Digital Signature Algorithm](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm)) or `EdDSA`( [Edwards-curve Digital Signature Algorithm](https://en.wikipedia.org/wiki/EdDSA)) instead of `RSA` when configuring `SSH-CA` on `HashiCorp Vault`?
  
  **Tags:** hashicorp-vault, encryption, ssh
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-07-09. Score: 3 | Accepted answer
  
  I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both.
  
  You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot sign using it. I haven't tried ed25519.
  
  Golang's ssh code (which vault uses) doesn't appear to know how to sign with ed25519 but should be able to sign with ecdsa. However, I think there's an issue with an inappropriate default being set elsewhere that means it is always being told to use an rsa-based signing algorithm and hence doomed to fail for ecdsa keys. See:
  
  <https://github.com/hashicorp/vault/issues/8414#issuecomment-656145432>
  
  If I am right, it looks like an easy fix so it may be available soon.
  
  This is possible as of August 2020, see <https://github.com/hashicorp/vault/pull/9824>, tested with vault 1.6.2
  
  > **Comments:**
  > **username_0**: Yep, you're right, raised with Hashicorp Enterprise support, no answer yet.  
  
  ---
  
  