4

Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?

  • Generally by an ssh agent that unlocks and remembers the key when you use your password to unlock your computer. – AndrolGenhald Dec 17 '18 at 20:20
  • @AndrolGenhald Is it therefore possible for someone to still hack into the computer and check the SSH agent for the private key? – Engineer999 Dec 17 '18 at 20:24
4

For SSL/TLS, you usually do not have or use a private key, unless you are the server. If you are the server, or are using client certificates (TLS mutual authentication), then the private key will need to be unlocked (if password-protected) before use. The details are implementation-specific.

  • A web browser like Firefox might ask you for a key's password once and then cache that until the browser is closed.
  • Browsers or servers (like IE/Edge/Chrome or IIS) that use Windows' key store will either get a password prompt when the key is used, or will have only needed the password when the key was added to the key store and will then have encrypted it using a key protected by your Windows login credentials such that you don't need to re-enter the password but nobody who doesn't know your Windows password can use the key.
  • Macs can store keys in the Keychain, which works similarly to Windows' key store and is used by Safari and Chrome.
  • Software that does not use platform-provided key management or prompt the user for a password will need to have the password supplied on the command line when the program starts, stored somewhere (preferably in an environment variable or a file, but some people insist on hard-coding it into the source). This is very common for server applications that need to access e.g. a Java key store and its private keys, and yes, it's a security risk if an attacker gains the ability to read local files.

For SSH, the most common approach is the ssh-agent program (included with openssh, or you can use an alternative one). ssh-agent needs your key's password when it is launched, but then retains the unlocked key until the program closes. ssh-agent doesn't actually reveal the key to anybody; it instead acts as a service that will sign data with that key. The program's IPC endpoint is only reachable by programs running as the same user (or with super-user privileges), so while untrustworthy software running in your account could effectively use the key to SSH into any machine, once you've reached the point of malicious software in your user session you are already in big trouble.

  • Ok thanks. In my case I use both SSH and SSL. For SSL I have a client device that communicates with a server on the Amazon AWS IoT platform. For the required TLS mutual authentication using certificates, the private key is used on the device to sign its certificate. I am not prompted for a password when starting the communication tho , so this is my confusion – Engineer999 Dec 17 '18 at 20:41
  • Without knowing more of the implementation of the device, I can't say for sure. It's possible the private key just doesn't have any password at all - it's not as though a password is an intrinsic property of such keys, it's just that they key is typically encrypted with a password-derived symmetric key - but it's more likely that the password is either hardcoded into the device's firmware or stored in a file somewhere on the device's file system. – CBHacking Dec 18 '18 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.