Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So what is the use of protecting the ssh key with password when the notebook has full disk encryption? If someone is able to get the id_rsa then it is able with no effort (?) to get the id_rsa's password from memory, because it's stored in the memory in a cleartext format? (using ex.: ssh-agent)
Q: with FDE, is it worth it to use pwd on id_rsa?
You asked about if ssh-agent stores the key passwords in cleartext. I think from looking at the code we would probably find that it doesn't store the passphrase used to decrypt it but does store the decrypted key that is then used to establish an SSH connection.
But there's a more important issue in point. If an attacker has access to your system memory (RAM), installing for example a keylogger or some other RAT malware would be trivial.
You have clarified your question to ask if it's necessary to password protect your private key when you have full-disk encryption. I would argue yes it is, because full-disk encryption is a protection against offline attacks. Once you're booted into your system, any attack which compromises your running system (most likely with your user credentials through a web browser exploit) would be able to read your private key file. If the key file is encrypted, then you have averted this threat.
If you have encrypted your private key, and the attacker gains access to your live system while the private key is in memory, they would now have to use privilege escalation exploits to gain the ability to read those keys in memory. These techniques get complicated when you consider they would need to figure out exactly where the key in memory existed, else make your Internet connection upload your entire memory pool - something you are likely to notice.
If someone is able to get the id_rsa then it is able with no effort (?) to get the id_rsa's password from memory, because it's stored in the memory in a cleartext format?
It is not trivial to get access to the full contents of a machine's RAM. But if someone does have access to the contents of your machine, then that machine has been fully and completely owned, including everything on it.
Q: with FDE, is it worth it to use pwd on id_rsa?
Storing private information (e.g. SSH keys) encrypted even on machines with FDE is justifiable. Any process running on that machine in any context (including otherwise untrusted code) is not hindered by full disk encryption, as the OS transparently decrypts the disk on-the-fly.
Instead, full-disk-encryption protects the disk from being read "at rest", outside the context of your running system.
As to whether credentials are stored in-memory unencrytped, that'd be an implementation detail specific to a given product. But since there's really no other way to use the key except to decrypt it, then most likely yes.
