How to fix ssh-keygen: unknown key type in SSH

First, verify which version of OpenSSH you have, as different versions support different key types:

ssh -V

This displays your OpenSSH version (e.g., 'OpenSSH_8.2p1 Ubuntu-4ubuntu0.7, OpenSSL 1.1.1f 31 Mar 2020').

Key type availability:
- OpenSSH 6.5+: ed25519 support added
- OpenSSH 7.0+: DSA (dsa) deprecated and disabled
- OpenSSH 5.3: Only supports rsa, dsa, ecdsa

Use one of these standard, supported key types:

Modern systems (OpenSSH 6.5+):

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

Ed25519 is recommended for new keys—it's fast, secure, and works everywhere modern.

Broader compatibility (supports older servers):

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa

RSA with 4096 bits is the traditional fallback if you need maximum compatibility.

Elliptic Curve (modern, good compatibility):

ssh-keygen -t ecdsa -b 521 -f ~/.ssh/id_ecdsa

ECDSA with 521 bits provides good security and is widely supported.

Always use lowercase key type names: ed25519, rsa, ecdsa (not ED25519, RSA, etc.).

Do NOT use DSA keys on any modern OpenSSH version:

# Wrong - DSA is deprecated and disabled in OpenSSH 7.0+
ssh-keygen -t dsa -f ~/.ssh/id_dsa

If you're stuck with an old system that requires DSA, you should upgrade that system. DSA is cryptographically broken and should never be used.

If you must generate keys for a very old OpenSSH server (pre-6.5), use RSA instead:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa

The most common mistake is misspelling the key type. Verify these common errors:

Wrong (typo in type name):

ssh-keygen -t rsa2048     # ❌ Wrong: '2048' is not part of type
ssh-keygen -t RSA         # ❌ Wrong: Must be lowercase 'rsa'
ssh-keygen -t ecdsa-256   # ❌ Wrong: Use -b flag for key size
ssh-keygen -t dsa-sk      # ❌ Wrong: Unsupported type on most OpenSSH versions

Correct:

ssh-keygen -t rsa -b 2048          # ✅ RSA with 2048-bit size
ssh-keygen -t rsa                  # ✅ lowercase, default 3072 bits
ssh-keygen -t ecdsa -b 256         # ✅ ECDSA with -b for key size
ssh-keygen -t ed25519              # ✅ Ed25519 (no -b needed, fixed size)

The key type goes in -t, and the key size goes in -b. They are separate options.

If you're trying to use hardware security keys (FIDO2 keys):

# These require OpenSSH 8.2+
ssh-keygen -t ed25519-sk -f ~/.ssh/id_ed25519_sk     # Ed25519 on security key
ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk         # ECDSA on security key

Check your version:

ssh -V

If you have OpenSSH older than 8.2, you cannot use -sk variants. Use standard ed25519 or rsa instead, or upgrade OpenSSH.

On some systems, ssh-keygen might be aliased or wrapped by a script. Check:

which ssh-keygen

Shows the path, e.g., /usr/bin/ssh-keygen. Try using the full path directly:

/usr/bin/ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

If that works but plain ssh-keygen doesn't, you have an alias or wrapper interfering:

# Check for alias
alias ssh-keygen

# Temporarily bypass it
unalias ssh-keygen
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519