Cloning my repo / problem importing SSH key

[hcgrove]

Hi

I've been using pass on my linux machines for some time and thought it was time to access to my passwords on my android phone. So I installed this app (version 1.13.2, installed from f-droid), and copied my SSH key (both public and private part) and my GPG key to the phone.

When I start the app I go to SETTINGS and import my SSH key.

Then I go back and press the "LET'S GO" button, and "CLONE REMOTE REPO". Then under Server/"Reposittory URL" I put 'ssh://@:/', under Server/"Branch" I just leave it to say "master", and under "Authentication Mode" I select (I think it was the default) "SSH KEY".
When I then press "CLONE" I'm presented with a dialog saying
"Authenticate"
"Please provide the password for the repository"
an input field titled "Passphrase" and a checkbox with the option to "Remember password" (not checked).

There is no password associated with the repository, so the text is a bit confusing, but no matter what I enter the result is an error dialog saying:
"An error occured during a Git operation"
"Problem getting public key from PKCS8KeyFile{resource=[PrivateKeyFileResource] /data/user/0/dev.msfjarvis.aps/files/.ssh_key}"

I don't see the need for the public key (but it's in privat_rsa.pub in the same directory where I chose privat_rsa when I imported the key).

Am I doing something wrong? And if so: what?

[msfjarvis]

Is the URL that you're using really ssh://@:/ and has no actual remote location to connect to? Are you sure that you imported the right file?

I just tried connecting to my own Linux PC through my phone and was able to do so perfectly fine following these same steps but with a full URL (ssh://<username>@<local IP of PC>:<port>/path/to/git/repo) and ensuring that the imported SSH key was a valid ED25519 private key.

[hcgrove]

No, GitHub apparently ate the stuff in <>. The URL is used is as in your example: ssh://<user>@<hostname>:<port>/<repo>. The main difference as I see it is that the hostname I use resolves to a global IP..

[fmeum]

This seems related: hierynomus/sshj#437 (comment)

[hcgrove]

It does. But the openssl command given removes the passphrase from the SSH key. I don't want that, especially not on my phone (which I consider to be a bit more exposed.

If android-password-store does not support properly protected SSH keys, I see two better options:

1. Continue living without access to my passwords on the phone
2. Use android-password-store to generate a key and use it exclusive for this (restrict it server-side - does anyone know the syntax for putting into .ssh/authorized_keys? I know it can be done, I've just never tried it).

[fmeum]

It does. But the openssl command given removes the passphrase from the SSH key. I don't want that, especially not on my phone (which I consider to be a bit more exposed.

If android-password-store does not support properly protected SSH keys, I see two better options:

1. Continue living without access to my passwords on the phone
2. Use android-password-store to generate a key and use it exclusive for this (restrict it server-side - does anyone know the syntax for putting into .ssh/authorized_keys? I know it can be done, I've just never tried it).

The best way to protect SSH private keys is to never copy them anywhere, but instead generate them directly on the (only) device they will be used on, ideally storing them in secure hardware (YubiKey, Android Keystore, Mac Secure Enclave).

If you generate an SSH key within APS, it will be stored in the Android Keystore protected with your screen lock/biometrics. It will allow you to copy and share the public key, which you then need to add as a line to .ssh/authorized_keys.

[agrahn]

@fmeum You said the local, APS-generated ssh private key is additionally encrypted with the 4-digit screen lock number sequence. Is it possible to use a different number sequence, perhaps consisting of more digits? There are other Android apps that allow the app to be protected with a different PIN, such as the Signal messenger and the web.de cloud app.

[fmeum]

The private key is encrypted with whatever you choose to be your screen lock - you can also make it an 8-digit PIN, a fingerprint scan or an alphanumeric password.

Since APS is using the OS-provided facilities to store the key in secure hardware, we can't use a locking mechanism that isn't your screen lock. Adding such functionality would require an entirely separate encryption/decryption operation that isn't backed by hardware and thus potentially very easy to bruteforce.

@agrahn What is your use case? I don't quite understand why you would want to protect the generated SSH private key better than your phone itself - after all, if someone is able to extract the key, they still can't read your passwords since they are encrypted. They can modify the repo and plant a malicious .gpg-id, but that is better to prevent in other ways and also not a big deal if you happen to have a signed backup you can recover from after losing your phone.

[agrahn]

Thank you a lot for clarifying! I just wondered if a person that somehow got knowledge of the phone's lock screen PIN could vandalise the password db and then push it to my home-based git repo. Of course I could always git-reset the remote repo after such an incident. And of course, the gpg keys are backed up and AES-encrypted so that everything can be recovered. Thanks for the details about the way keys are stored on the Android device. This was really reassuring. In parallel I was using original Pass in Termux, using passphrase protected ssh keys, but now I think it would be better to shred everything Pass-related there.