Is it safe to derive a password from a signature provided by ssh-agent?

Question

I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of authentication is not an option.

One possible solution is to talk directly to ssh-agent and have it sign a constant token and then use, say, the signature's base64-representation as the password. This password can always be re-generated, assuming access to the private key and knowledge of the token.

https://gist.github.com/mprymek/10415576 shows that this technique is being used in the wild.

1. Is this approach (deriving a password from a signature) cryptographically sound?

2. Is this approach secure? For example, when SSH agent forwarding is used, is the signing request and response (exchanged between remote host and local ssh agent) safe from eavesdropping?

EDIT: draft-ietf-secsh-agent-02 section 4.2 says that forwarding happens through an SSH channel, and the abstract of RFC 4254 says that "channels are multiplexed into a single encrypted tunnel" which I believe means that agent forwarding is fully encrypted.

Answer 1

Is this approach (deriving a password from a signature) cryptographically sound?

Not in general. There are signature algorithms that are completely deterministic and signature algorithms that aren't. With the latter kind you would be unable to reproduce the password later.

With a deterministic algorithm, yes, the basic idea of using the signature as a password is sound (assuming no attacker can get the signer to sign the same token in some other situation). If it wasn't secure, that would mean the attacker had some way to produce the same signature, which would mean the signature algorithm itself would be broken.

Note that rather than sending a token for the client to sign, an SSH v1 server actually encrypts a token, sends it to the client and stores a hash. The client must decrypt the token and reproduce the same hash in its response. (See section 2.3 of the document you linked.) This is likely why the linked program talks about 160-bit passwords.

A similar argument as above makes this secure: to know the hash an attacker has to either know the original token generated by the server or be able to decrypt the challenge (which they can't do without the key, unless the encryption algorithm is broken).

Is this approach secure? For example, when SSH agent forwarding is used, is the signing request and response (exchanged between remote host and local ssh agent) safe from eavesdropping?

As for whether that's safe from eavesdroppers... yes, if you assume they are outside the systems involved. An attacker with sufficient control over the final destination machine could eavesdrop the original challenge generation. An attacker with sufficient control over the source machine where you authenticate could similarly eavesdrop the response generation.

I'm not entirely sure whether an attacker on the middle machine would be able to do the same, but I believe so. As I understand the forwarded traffic passes unencrypted from ssh to sshd and is only encrypted between the hosts. That's (one reason) why some people have suggested using more complicated layered ssh connections instead of agent forwarding.