AWS transfer documentation change
Summary
Added documentation for using Windows built-in OpenSSH to generate SSH keys alongside existing PuTTYgen instructions. Expanded key generation examples with RSA 4096, ECDSA 521, and ED25519 algorithms.
Security assessment
The change improves security documentation by promoting modern key algorithms (like ED25519) and native OpenSSH usage, but does not address a specific disclosed vulnerability. Enhanced cryptographic guidance contributes to better security practices.
Diff
diff --git a/transfer/latest/userguide/windows-ssh.md b/transfer/latest/userguide/windows-ssh.md index dd00c8243..672b77b74 100644 --- a//transfer/latest/userguide/windows-ssh.md +++ b//transfer/latest/userguide/windows-ssh.md @@ -4,0 +5,2 @@ +Using Windows built-in OpenSSHUsing PuTTYgen (third-party tool) + @@ -7 +9,30 @@ -Windows uses a slightly different SSH key pair format. The public key must be in the `PUB` format, and the private key must be in the `PPK` format. On Windows, you can use PuTTYgen to create an SSH key pair in the appropriate formats. You can also use PuTTYgen to convert a private key generated using `ssh-keygen` to a `.ppk` file. +Windows includes OpenSSH as a built-in feature, which you can use to generate SSH keys in the same format as on Linux or macOS. Alternatively, you can use third-party tools like PuTTY's key generator (PuTTYgen). + +## Using Windows built-in OpenSSH + +Recent versions of Windows include OpenSSH by default. You can use the same `ssh-keygen` commands as described in the macOS/Linux section: + + 1. Open Windows PowerShell or Command Prompt. + + 2. Run one of the following commands based on the type of key you want to generate: + + * To generate an RSA 4096-bit key pair: + + ssh-keygen -t rsa -b 4096 -f key_name + + * To generate an ECDSA 521-bit key-pair: + + ssh-keygen -t ecdsa -b 521 -f key_name + + * To generate an ED25519 key pair: + + ssh-keygen -t ed25519 -f key_name + + 3. Follow the same steps as in the macOS/Linux section to upload your public key to AWS Transfer Family. + + + + +## Using PuTTYgen (third-party tool) + +Some third-party SSH clients for Windows, such as PuTTY, use different key formats. PuTTY uses the `PPK` format for private keys. If you're using PuTTY or related tools like WinSCP, you can use PuTTYgen to create keys in this format. @@ -13 +44 @@ If you present WinSCP with a private key file not in `.ppk` format, that client -For a tutorial about creating SSH keys by using PuTTYgen on Windows, see the [SSH.com website](https://www.ssh.com/ssh/putty/windows/puttygen). +For a tutorial about creating SSH keys by using PuTTYgen, see the [SSH.com website](https://www.ssh.com/ssh/putty/windows/puttygen).