Creating Keys with Public-Key Authentication Wizard

On Linux, you can use the Tectia Public-Key Authentication Wizard to generate a key pair. The wizard will generate two key files, your private key and your public key, and store them in the $HOME/.ssh2 directory on your local computer. The public key has .pub as the file extension, and the private key file has the same base file name as the public key but no file extension.

Public key pairs can also be generated with the command line tool ssh-keygen-g3. For instructions, see Creating and Uploading Keys with the Command Line Tools.

Go to the /opt/tectia/bin directory by entering:
```
$ cd /opt/tectia/bin/
```
Start the Tectia Connections Configuration GUI with the following command:
```
$ ssh-tectia-configuration
```
Go to User Authentication and select the Keys and Certificates page. Click New key.
Figure 4.2. Tectia Connections Configuration GUI, Keys and Certificates view
The Public-Key Authentication Wizard starts.
Figure 4.3. The Public-Key Authentication Wizard

Define the key properties and the required passphrase to protect your key pair.

File Name

Type a unique name for the key file. The wizard suggests a name consisting of your user name and the host name.

Comment

Write a short comment that describes the key pair. For example, describe the connection the key is used for. The wizard suggests a comment consisting of the key length and type, your user name and the host name, and the current date and time. This field is not obligatory, but it helps to identify the key later.

Passphrase

Type a phrase that is difficult to guess. Use at least 8 characters, both letters and numbers. Any punctuation characters can be used as well.

	Note
	In FIPS mode, due to a FIPS regulation which forbids exporting unencrypted private keys out of the FIPS module, it is not possible to generate user keys without a passphrase.

If the key pair will be used for automated jobs, you can leave the passphrase field empty to generate the key without a passphrase.

You will be requested to enter the passphrase always when using the keys to authenticate yourself. The passphrase works in a way similar to a password and gives some protection for your private key.

Memorize the passphrase carefully, and do not write it down.

Retype passphrase

Type the passphrase again. This ensures that you have not made a typing error.

Click the Advanced Options if you want to define the type and/or length of the key to be generated to be different from the defaults. By default, Tectia Client generates a pair of 2048-bit RSA keys.
In the Key Properties area, you can define the following:
Key Type
Select the type of the key to be generated. Available options are DSA, RSA, ECDSA and Ed25519.
Key Length
Select the length (complexity) of the key to be generated. Available options are:
DSA/RSA keys: 1024, 2048, 3072, 4096, 5120, 6144, 7168, 8192 bits
Note
In FIPS mode (conforming to FIPS 186-3) the available DSA key lengths are limited to 1024, 2048 and 3072 bits.
ECDSA keys: 256, 384, 521 bits
Ed25519 keys: 512 bits
Note
Ed25519 keys are not available in FIPS mode.
Larger keys of the same key type are more secure, but also slower to generate. A 256-bit ECDSA key and a 3072-bit DSA or RSA key provide equivalent security.
Click Next to proceed to uploading the key. The wizard continues with Step 3 in Uploading Public Keys Automatically.

Uploading existing public keys to new remote servers is instructed in Uploading Public Keys Automatically.

	Note
	In FIPS mode (conforming to FIPS 186-3) the available DSA key lengths are limited to 1024, 2048 and 3072 bits.