A better summary. [LWN.net]

A better summary.

Posted Jun 10, 2026 8:03 UTC (Wed) by mjg59 (subscriber, #23239)
In reply to: A better summary. by Karellen
Parent article: Eliminating long-lived credentials with trusted publishing

Yes. But they're also typically loaded into an SSH agent at either login or first use, and if an attacker has the ability to compromise that agent (either by just ptracing it, or LD_PRELOADing something into it on next login, or any number of other ways) then they can extract the private keys.

Of course, if an attacker is in a position to do those things, they're also in a position to grab your GPG passphrase the next time you type it in, so the distinction is basically irrelevant. The only real way to protect private keys on a compromised system is for them to be hardware backed, and you can do that just as well with SSH keys as you can with GPG ones.

to post comments

A better summary.

Posted Jun 10, 2026 8:36 UTC (Wed) by taladar (subscriber, #68407) [Link] (3 responses)

GPG keys are also typically loaded into a GPG agent.

A better summary.

Posted Jun 10, 2026 8:37 UTC (Wed) by mjg59 (subscriber, #23239) [Link] (2 responses)

At login time, or after first use in a session? It's pretty common for SSH keys to be automatically loaded when you log in, which means they're exposed even if you haven't used them. I don't think this is a terribly important distinction, but it is a distinction.

A better summary.

Posted Jun 10, 2026 14:54 UTC (Wed) by mbunkus (subscriber, #87248) [Link]

Personally I use KeepassXC & store the important, root-/admin-level access giving keys there. I have it set to auto-remove those keys from the agent after 2 hours. When I need to use them I add them manually via KeepassXC.

Though that leaves the question if that's actually meaningfully different from having it in the agent all the time — if an attacker can trace my running ssh-agent, it can trace my running KeepassXC.

A better summary.

Posted Jun 12, 2026 22:50 UTC (Fri) by jengelh (subscriber, #33263) [Link]

gpg-agent has `default-cache-ttl` and `max-cache-ttl` (default: 10min/2h). ssh-agent/ssh-add only has -t (equivalent to max-cache-ttl), with a time-unlimited default. That's quite the difference.