Choose for policy and compatibility
Ed25519 is a useful choice when supported by your server and security policy. Use RSA 3072 or 4096 where compatibility or policy requires it. An RSA key is not synonymous with the old SHA-1 ssh-rsa signature: modern RSA can use SHA-2. Do not globally re-enable legacy signatures.
Generate locally and protect the private key
Choose one command and a new filename; do not overwrite an existing key. Set a passphrase when prompted. Only the .pub file belongs on the server. Keep the private key on the client. CH-J Key Generator is already available in Beta 0.1.0.
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_chj
ssh-keygen -t rsa -b 3072 -f ~/.ssh/id_rsa_chj
ssh-keygen -lf ~/.ssh/id_ed25519_chj.pub -E sha256Install the public key, then test
Put the complete public key on one line in the target account’s ~/.ssh/authorized_keys. On Linux, check account ownership and typically mode 700 for .ssh and 600 for authorized_keys. Keep your current session open and test a second login with the selected key before changing old access. User keys and server host keys serve different purposes.
ls -ld ~/.ssh ~/.ssh/authorized_keys
ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519_chj user@server.example