Octa PassGitHubGet updates

All changes

SSH keys get their own item type

SSH keys are now a first-class item instead of a secure note: a private key, public key, key type, SHA256 fingerprint, comment and an optional passphrase for exports, with the fingerprint as the list subtitle.

  • Generate Ed25519, ECDSA P-256/P-384 or RSA 3072/4096 from the Octa Pass core, on the device. The private key never leaves the device unencrypted.
  • Import OpenSSH, PEM (PKCS#1, SEC1, DSA) and PKCS#8 private keys, with or without a passphrase. Wrong passphrases, public keys, malformed files and unsupported formats each get a clear message. DSA and FIDO (sk-) keys are kept with their public key but can’t be used yet.
  • View and export the public key and fingerprint freely; the private key is shown, copied or saved only after confirming the master password or device unlock again. Export writes an OpenSSH private key with an optional passphrase, or the .pub / authorized_keys line.
  • CLI: octapass ssh list | generate | import [--scan] | export | public, with private files written 0600 and no overwrite without --force.
  • Extension: SSH key items show their fingerprint and copy the public key; the private key stays out of the extension.
  • CXF and Octa Pass exports carry SSH keys losslessly; CXF uses its ssh-key credential type.

The SSH agent, the desktop app’s ~/.ssh integration and the native phone screens are next. See SSH keys.