23 ms·
How does a client bug end up leaking private key material to the server if the private key is in an entirely different process (the agent)? Or is this only an i
by hamburglar 11y ago
How does a client bug end up leaking private key material to the server if the private key is in an entirely different process (the agent)? Or is this only an issue if you are loading your identity directly in the client?
- singlow 11y agoI would love to hear from someone who knows the answer to this. Does this affect ssh-agent? I am rotating my keys regardless, but I am curious.
- TimWolla 11y agoAccording to: https://news.ycombinator.com/item?id=10902833 https://news.ycombinator.com/item?id=10902833 it does not: > Finally, for these three reasons, passphrase-encrypted SSH keys are leaked in their encrypted form, but an attacker may attempt to crack the passphrase offline. On the other hand, SSH keys that are available only through an authentication agent are never leaked, in any form.