Bitbucket requires keys to be at least 1024 bits long, but mine is!

Question

So I want to set up SSH between sourcetree and my bitbucket account. In sourcetree I click create SSH key and in the pop up menu I create a key with default settings (wich is 1024 bits length). Then I go to bitbucket and set up SSH, it then asks me to copy paste the key, which I do. But then it rejects the key for not being 1024 bits long, while it was made with the setting at 1024 bits!

Am I doing something wrong or is this a bug?

Bernát Gyovai · Answer

I know this is an old issue, and Keys are required to be "at least 2048" bits long. But you guys forgot to put an equals sign on the checking part of your code... (again) :)

Keys are not required to be "at least least 2048" but they have to be longer that that. :D  2048 is not enough.

Mark Adams · Answer

Hi Lennart!

Jim is definitely correct that we recommend that SSH keys using RSA have a key strength of at least 2048 bits to continue to be secure. I think the simplest solution to your issue is to try generating a 2048-bit key instead.

However, it is odd that the key generated by Putty is not passing our validation. If it wouldn't be too much trouble, could you file a support ticket at http://support.atlassian.com and include the failing public key so that we can analyze it in more detail?

Thanks!

Mark Adams
Sr Developer, Bitbucket

jredmond · Answer

I would strongly urge you to build larger keys - at least 2048 bits for RSA, and bigger if you can. 1024-bit RSA keys have not been considered secure for quite some time now (http://csrc.nist.gov/groups/ST/toolkit/documents/draftSP800-131_June_11_2010.pdf is a recommendation from 2010 to phase out 1024-bit keys) and I'm surprised we still support RSA keys that small.

I'd also check to see if a newer version of Putty supports elliptic key algorithms, such as ECDSA or Ed25519.