Question

I’m planning to write some software using SFTP with public/private key authentication to upload files to a server. I am wondering how people recommend managing the keys (especially the private key).

My target platform is Windows with C# or C++. I’ve looked at a number of libraries:

C#
(free/open)
SharpSSH
Granados

(commercial)
Rebex

C++
libcurl/OpenSSH

All of these appear to require the private key to be stored on the filesystem, which I would prefer to avoid for security reasons. I would also prefer not to implement the authentication myself although I recognize that as an option. My questions:

Is there a way to feed any of these libraries (or any library/API I may have overlooked) the key values directly from memory instead of loading from a file?

If not, what is the recommended way to manage these key files? Beyond password encryption and tight access control, are there other things one should do to protect the key file?

Answer 1

I’ve never used Granados, but that library’s SSH2UserAuthKey class has a FromSECSHStyleStream method that loads a user’s authentication key from an arbitrary Stream (which could be a MemoryStream if you want to load the key directly from memory). It seems like this would let you bypass the filesystem for key storage.

Rebex.Net has a SshPrivateKey class constructor that can load from a byte[]; this should also let you avoid the filesystem.

While I haven’t checked the other libraries, it seems likely that all of them would provide methods to load a key from a byte[], MemoryStream, or unsigned char*, with convenience methods that load directly from a file.

These APIs don’t solve the problem of how the private key will actually be stored, though. You could password-protect it (this seems a fairly common approach with SSH private keys) or use the ProtectedData class to encrypt it with the current Windows user’s credentials.