Where does Windows OpenSSH ssh-agent service secretly store private keys

user_14965927 0
Viewed 944

Got the Windows10 Pro additional feature "OpenSSH-Client" which includes ssh-agent functionality. Keys can be added to the agent with ssh-add. Much to my surprise this Windows implementation seems to store these private keys ON DISK - standard ssh-agent will only store them in RAM. Just try this:

ssh-add <private key from thumbdrive>
## remove thumbdrive
## stop ssh-agent service
## start ssh-agent service
ssh-add -l

And, Lo and Behold, keys are still there; even reboot won't wipe them!

So now my really, really secure private keys are somewhere on the system disk. How can I erase them and any relics that might be still on disk? Does anyone know the location where these are kept?

BTW. personally, I find this a bad feature extension to the original OpenSSH ssh-agent

openssh windows
1 Answers

OK, answering my own question:

Short awnser: ssh-add -D will delete the keys .... sort of.

Keys are stored in the Registry under HKCU\Software\OpenSSH\Agent\Keys. Figured this out from the source at https://github.com/PowerShell/openssh-portable/releases/tag/v8.1.0.0 in file contrib/win32/win32compat/ssh-agent/keyagent-request.c

On the plus side, this implementation uses DPAPI on the private part of the stored key. On the other hand, with the right privilege, ImpersonateLoggedOnUser can be used to decrypt this stored key.

Sadly, this implementation does not use the rigorous deleting method (BN_clear_free) as found in the original - a simple RegDeleteTreeA is supposed to suffice. So for real removal tinkering with ntuser.dat.log would be needed. The actual storage of the private keys on disk is NOT compliant with with the manpage for the original:

The agent initially does not have any private keys.

Overall: although called the same, it is a very different thing. Some warnings about the use of this ssh-agent implementation:

  • it stores secret keys ON DISK - never use in a shared or guest situation
  • (traces of) secret keys remain ON DISK after deletion
  • this implementation does not conform to the openssh manual page ssh-agent.1 in key aspects of security.
user_149659270
Related