3 ms·
So, good reason to use the Cygwin version of ssh-agent? I assume it doesn't suffer from the same thing.
by e40 8y ago
So, good reason to use the Cygwin version of ssh-agent? I assume it doesn't suffer from the same thing.
- EvanAnderson 8y agoI don't understand what it "suffers" from. It's performing as-intended. A user needs to be able to retrieve the plaintext of their SSH private keys. There's nothing that seems architecturally unsound about how Microsoft implemented this. DPAPI is a reasonable way to protect the keys "at rest" in the registry. The OP was able to extract the keys because he has the credentials for the user from whom he is extracting the keys. Short of storing the keys in the memory of a dedicated crypto-processor outside the host computer (and performing the cryptographic operations there) the plaintext of the private keys will have to be recoverable to the user.
- throwaway2048 8y agothe entire point of agents is that they DON'T just hand you key plaintext, otherwise what would the point of them be compared to just an un-encrypted file. ssh-agent signs requests, tokens, etc on your behalf. You never see the private key.
- Arnavion 8y ago... which is why the blog post is about figuring out how to decrypt the underlying storage that ssh-agent reads from to get to the private key. Edit: If your point was specifically about this from EvanAnderson's comment >A user needs to be able to retrieve the plaintext of their SSH private keys. then the "user" there is the abstract identity used to locate and decrypt the private key, not the human invoking ssh-agent.
- ropnop 8y agoI haven't looked at Cygwin's ssh-agent but I'm sure it's possible to achieve the same thing. The unencrypted private keys have to be stored somewhere (either in memory or protected on disk). Could probably just dump Cygwin's memory and extract from there.