Feature Request: Enter passphrase with `ssh-tpm-add`

[Cornelicorn]

Hi,

we want to use ssh-tpm-agent for user SSH keys, which should reside on a central machine for policy reasons, which means users would need to login to thist host directly via ssh and then use the tpm-bound keys from there to connect to other hosts.

Currently, ssh-tpm-add doesn't prompt for the passphrase, but ssh-tpm-agent does, which works well for a desktop system, where you have a visual prompt from ssh-askpass. For ssh access, this fails (as also already stated in #115).

For the normal ssh agent this does work, since ssh-add will ask for the passphrase of the key when called on the commandline directly. It would be nice if ssh-tpm-add would also support asking for the passphrase when adding the key and not at the time of first usage.

[Foxboron]

The main issue here is that the password for the key is going to be in the memory of ssh-tpm-agent. This does not happen with openssh as it parses the private key, adds it to the agent and then nulls out the memory.

Is this an acceptable caveat?

I could maybe try to back the password with mmap, but it would not be a 100% guarantee against anything.

[Cornelicorn]

Is this an acceptable caveat?

I'm not sure whether this is a rhetorical question 😅 .

Could loading the private key work like it does for openssh if there is no owner password? Then only the private key file would be encrypted with the passphrase and the decrypted key could be loaded into the agent if I understand the mechanics correctly?

[Foxboron]

I'm not sure whether this is a rhetorical question 😅 .

It was an honest question. Your threat model is not specific so for all I know it might be viable?

Could loading the private key work like it does for openssh if there is no owner password? Then only the private key file would be encrypted with the passphrase and the decrypted key could be loaded into the agent if I understand the mechanics correctly?

Mmm, maybe? TPMs can only hold 3 loaded objects so that would put some weird limits on the usage of ssh-tpm-agent that would need to be accounted for. Currently we lazy load keys when we need to use them. So any policies (read "pins" or "passwords") needs to be utilized when they are loaded.