Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So what is the use of protecting the ssh key with password when the notebook has full disk encryption? If someone is able to get the id_rsa then it is able with no effort (?) to get the id_rsa's password from memory, because it's stored in the memory in a cleartext format? (using ex.: ssh-agent)

Q: with FDE, is it worth it to use pwd on id_rsa?

share|improve this question
I can't think of a situation where someone would have unfiltered access to your RAM, in such a way that doesn't constitute a complete compromise of your machine. – Polynomial Jul 31 '13 at 10:23
@Polynomial If somebody steals a suspended laptop it is useful to know whether the password was compromised or only the data on the machine. – kasperd Jul 30 '15 at 5:30
@kasperd Right. But if they have physical access, they can just install a hardware keylogger, or a PCI card with memory access, or any other kind of hardware backdoor. – Polynomial Aug 6 '15 at 11:03
@Polynomial Installing a keylogger without being noticed is much harder than just grabbing a suspended laptop and running away with it. – kasperd Aug 6 '15 at 11:24
@kasperd Not necessarily. Evil maid attacks, etc. are common threat scnearios. – Polynomial Aug 6 '15 at 11:59
up vote 11 down vote accepted

You asked about if ssh-agent stores the key passwords in cleartext. I think from looking at the code we would probably find that it doesn't store the passphrase used to decrypt it but does store the decrypted key that is then used to establish an SSH connection.

But there's a more important issue in point. If an attacker has access to your system memory (RAM), installing for example a keylogger or some other RAT malware would be trivial.

You have clarified your question to ask if it's necessary to password protect your private key when you have full-disk encryption. I would argue yes it is, because full-disk encryption is a protection against offline attacks. Once you're booted into your system, any attack which compromises your running system (most likely with your user credentials through a web browser exploit) would be able to read your private key file. If the key file is encrypted, then you have averted this threat.

If you have encrypted your private key, and the attacker gains access to your live system while the private key is in memory, they would now have to use privilege escalation exploits to gain the ability to read those keys in memory. These techniques get complicated when you consider they would need to figure out exactly where the key in memory existed, else make your Internet connection upload your entire memory pool - something you are likely to notice.

share|improve this answer
Great answer -- to step back, there's a point where some degree of attempted security on top of security tends to miss the larger set of attack vectors. All systems have many levels of insecurity; as a professional involved with security, I see the biggest mistake companies and people make is to focus on one thing without thinking about broader security, like having your machine lock on inactivity with a strong password. – Tom Harrison Jr Feb 21 at 18:01

If someone is able to get the id_rsa then it is able with no effort (?) to get the id_rsa's password from memory, because it's stored in the memory in a cleartext format?

It is not trivial to get access to the full contents of a machine's RAM. But if someone does have access to the contents of your machine, then that machine has been fully and completely owned, including everything on it.

Q: with FDE, is it worth it to use pwd on id_rsa?

Storing private information (e.g. SSH keys) encrypted even on machines with FDE is justifiable. Any process running on that machine in any context (including otherwise untrusted code) is not hindered by full disk encryption, as the OS transparently decrypts the disk on-the-fly.

Instead, full-disk-encryption protects the disk from being read "at rest", outside the context of your running system.

As to whether credentials are stored in-memory unencrytped, that'd be an implementation detail specific to a given product. But since there's really no other way to use the key except to decrypt it, then most likely yes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.