Re: https, client certificate, pem pass phrase

[Karsten Weiss <knweiss@gmx.de>]

On Thu, 11 Jun 2009, Karsten Weiss wrote:

> However, it only works as long as I do *not* protect the client's private key 
> (PEM) with a pass phrase which is not secure (especially when using 
> FakeBasicAuth!). When I do protect the private key with a pass phrase *each* 
> git fetch/pull/push prompts the user *several* times with "Enter PEM pass 
> phrase:". Thus, it's not usable (even though it works).

Somehow I managed to miss Mark Lodato's posting from 2009-05-28 before:

[PATCH 1/2] http.c: prompt for SSL client certificate password
http://marc.info/?l=git&m=124348062226665&w=4
[PATCH 2/2] http.c: add http.sslCertNoPass option
http://marc.info/?l=git&m=124348062326671&w=4

I can confirm that his two patches solve the problem. I.e. there is now 
only a single passphrase prompt during each Git invocation that involves 
the https protocol. Great!

However, I want to add two additional suggestions:

With the patch Git prompts for a "Certificate Password". IMHO it would be 
better to prompt for the "Certificate private key passphrase" because it's 
the private key which is protected and not the certificate itself. The 
config flag IMHO also should be renamed from http.sslCertNoPass to 
http.sslKeyNoPassphrase. (Of course it would be even nicer if the code 
could detect if the key has a passphrase and only prompt for it when 
really necessary)

Regarding the caching of the passphrase in memory: Maybe the passphrase 
memory region could be mlock()ed to prevent the kernel from paging it to 
disk? But I'm not sure if this is worth effort.