Security implications of storing an ssh passphrase I'm trying to understand the security implications of encrypting an ssh key with a passphrase, and storing the passphrase in the MacOS key chain or Gnome key-ring.

As I understand it, my ssh key passphrase needs to be long to prevent offline attacks (e.g., an attacker getting access to un-encrypted backups).

The operating system key-ring is encrypted using using my login password (OSX, gnome-keyring). The password normally isn't long (compared to a passphrase) as the operating system rate limits login attempts.

If I backup both my ssh key and my key-ring, have I reduced the complexity of cracking my ssh key from guessing my passphrase to guessing my password? Since it's implemented in both Gnome and MacOS and I haven't seen any warnings about this I feel like I must be wrong, but I'm not sure why.
(..) encrypting an ssh key with a passphrase (..and..) storing the passphrase in the MacOS key chain or Gnome key-ring (..) encrypted using my login password (..)If I backup both my ssh key and my key-ring, have I reduced the complexity of cracking my ssh key from guessing my passphrase to guessing my password?


Yes for competent attackers (as posited in cryptography), and as long at the key-ring does not use dedicated hardware to limit the number of (consecutive) invalid login password presentations (like for the PIN of Smart Cards).

Further, if the login password is short and the passphrase long and good, "reduced" implies "lowered" for all reasonable parametrization of the key stretching for the password and passphrase (key stretching use purposely slow computations in order to slow down dictionary search, and is becoming increasingly critical to any competent use of password, except perhaps with dedicated hardware to limit the number of password presentations).

Rationale for yes: with the methods used by the key-ring and login assumed known, finding its password allows to recover the passphrase (or perhaps, with tight integration of the ssh key encryption with the key-ring, perform anything that knowledge of the passphrase allows; but this is both unusual, and ineffective in the situation).