SSH Key Passphrase

Ask the Community Password Manager
, ,
1

I see that Bitwarden has SSH key support now, however I do not see the ability to add an SSH key passphrase? Am I missing something?

1 Like
2

AFAIK: It seems that Bitwarden stores the ssh keys unencrypted thus not needing the passphrase.
However, it prompts you every time the key is requested and you can decline its use at that point.

3

I really wish it would allow the storage of non-bitwarden ssh keys, including keys with passwords.

4

What would be a non-bitwarden ssh key ?

If that would be a ssh key-pair not generated by the bitwarden client, you can import it.

I personally don’t see the need of storing a ssh key in bitwarden protected by a passphrase, I would store that passphrase also on bitwarden, so it would be kinda pointless.

5

Thank you for sharing the link, and sorry for being so terse.

What I mean was I have machines that I access that I don’t want to load Bitwarden on. Those keys are in an ncrypted envelope that I would like to persist. So it would be great to import the key, with the envelope, and store the password along side it so either I could look it up, or the other use case is Bitwarden unlocks the envelope using the password attached to the record.

Also, from my understanding, Bitwarden has conventional keys that it doesn’t support yet. So if it ould be nice if it was simply, create a record where inputs are:

  • private key
  • public key
  • password
  • host rules
  • name
  • notes
6

Since Bitwarden vault is encrypted with your master password, as long as you are not storing the private key elsewhere, you can safely use SSH key without a passphrase. However, a passphrase encrypts the private key itself, so it does offer additional security in case your private key is exposed or stored in an unsecured location.

Yes, an option to provide a passphrase while creating a new SSH key in Bitwarden would be a great addition.

For now, I use ssh-keygen to create a key with a passphrase and use the ‘Import key from clipboard’ to bring it to Bitwarden (when doing this, a prompt appears to enter the passphrase that is saved with the key and doesn’t require to be re-entered again).