Security implications of storing an ssh passphrase

Question

I'm trying to understand the security implications of encrypting an ssh key with a passphrase, and storing the passphrase in the MacOS key chain or Gnome key-ring.

As I understand it, my ssh key passphrase needs to be long to prevent offline attacks (e.g., an attacker getting access to un-encrypted backups).

The operating system key-ring is encrypted using using my login password (OSX, gnome-keyring). The password normally isn't long (compared to a passphrase) as the operating system rate limits login attempts.

If I backup both my ssh key and my key-ring, have I reduced the complexity of cracking my ssh key from guessing my passphrase to guessing my password? Since it's implemented in both Gnome and MacOS and I haven't seen any warnings about this I feel like I must be wrong, but I'm not sure why.

Answer 1

(..) encrypting an ssh key with a passphrase (..and..) storing the passphrase in the MacOS key chain or Gnome key-ring (..) encrypted using my login password (..)
If I backup both my ssh key and my key-ring, have I reduced the complexity of cracking my ssh key from guessing my passphrase to guessing my password?

Yes for competent attackers (as posited in cryptography), and as long at the key-ring does not use dedicated hardware to limit the number of (consecutive) invalid login password presentations (like for the PIN of Smart Cards).

Further, if the login password is short and the passphrase long and good, "reduced" implies "lowered" for all reasonable parametrization of the key stretching for the password and passphrase (key stretching use purposely slow computations in order to slow down dictionary search, and is becoming increasingly critical to any competent use of password, except perhaps with dedicated hardware to limit the number of password presentations).

Rationale for yes: with the methods used by the key-ring and login assumed known, finding its password allows to recover the passphrase (or perhaps, with tight integration of the ssh key encryption with the key-ring, perform anything that knowledge of the passphrase allows; but this is both unusual, and ineffective in the situation).

Answer 2

Your login password doesn't need to be very long, it needs to be complex enough to withstand dictionary attacks, including advanced dictionary attacks with variations on the dictionary and combining two words which is probably the most we can do these days. Your password is hashed using some good PBKDF with a sizeable salt. This makes brute forcing it difficult. If your password is 1234 all the salting and slow hashing won't help you but the system is designed to give good security with reasonable passwords. In recent years people have begun advocating long memorable passwords since it appears people aren't very good at inventing short high entropy passwords. If your password was chosen from a large pool, and it remains a large pool even if you tell me how you chose it you are fairly safe. Obviously most attackers would try to avoide an offline bruteforce attack and prefer to actively steal your credentials during or after you enter them.