From b18fa68acc4218f4304e775b274f27b6e70e82a1 Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Fri, 30 Aug 2024 16:16:24 +0200
Subject: [PATCH 1/8] [PM-10395] Add new item type ssh key (#10360)

* Implement ssh-key cipher type

* Fix linting

* Fix edit and view components for ssh-keys on desktop

* Fix tests

* Remove ssh key type references

* Remove add ssh key option

* Fix typo

* Add tests
---
 apps/browser/src/_locales/en/messages.json    | 27 +++++++
 .../add-edit/add-edit-v2.component.ts         |  2 +
 .../item-copy-actions.component.html          | 24 ++++++
 .../item-copy-actions.component.ts            |  8 ++
 .../vault-v2/view-v2/view-v2.component.ts     |  2 +
 .../components/vault/add-edit.component.html  |  8 ++
 .../vault/vault-filter.component.html         | 13 +++
 .../components/vault/vault-items.component.ts |  3 +
 .../components/vault/view.component.html      | 23 ++++++
 .../vault-popup-items.service.spec.ts         |  1 +
 .../services/vault-popup-items.service.ts     |  1 +
 .../vault-popup-list-filters.service.spec.ts  |  1 +
 .../vault-popup-list-filters.service.ts       |  5 ++
 apps/desktop/src/locales/en/messages.json     | 27 +++++++
 .../vault/app/vault/add-edit.component.html   | 38 +++++++++
 .../src/vault/app/vault/add-edit.component.ts |  6 ++
 .../filters/type-filter.component.html        | 15 ++++
 .../src/vault/app/vault/view.component.html   | 49 ++++++++++++
 .../individual-vault/add-edit.component.html  | 55 +++++++++++++
 .../components/vault-filter.component.ts      |  6 ++
 apps/web/src/locales/en/messages.json         | 28 ++++++-
 .../vault/components/add-edit.component.ts    |  3 +
 libs/common/src/vault/enums/cipher-type.ts    |  1 +
 .../src/vault/icon/build-cipher-icon.ts       |  3 +
 .../src/vault/models/api/ssh-key.api.ts       | 17 ++++
 .../src/vault/models/data/cipher.data.ts      |  5 ++
 .../src/vault/models/data/ssh-key.data.ts     | 17 ++++
 libs/common/src/vault/models/domain/cipher.ts | 14 ++++
 .../src/vault/models/domain/ssh-key.spec.ts   | 67 ++++++++++++++++
 .../common/src/vault/models/domain/ssh-key.ts | 70 ++++++++++++++++
 .../vault/models/request/cipher.request.ts    | 13 +++
 .../vault/models/response/cipher.response.ts  |  7 ++
 .../src/vault/models/view/cipher.view.ts      |  7 ++
 .../src/vault/models/view/ssh-key.view.ts     | 26 ++++++
 .../src/vault/services/cipher.service.ts      | 14 ++++
 .../src/cipher-form/cipher-form-container.ts  |  2 +
 .../components/cipher-form.component.html     |  6 ++
 .../components/cipher-form.component.ts       |  2 +
 .../sshkey-section.component.html             | 18 +++++
 .../sshkey-section.component.ts               | 80 +++++++++++++++++++
 .../cipher-view/cipher-view.component.html    |  3 +
 .../src/cipher-view/cipher-view.component.ts  |  6 ++
 .../sshkey-view.component.html                | 31 +++++++
 .../sshkey-sections/sshkey-view.component.ts  | 35 ++++++++
 .../components/copy-cipher-field.directive.ts |  6 ++
 .../src/services/copy-cipher-field.service.ts |  8 +-
 46 files changed, 800 insertions(+), 3 deletions(-)
 create mode 100644 libs/common/src/vault/models/api/ssh-key.api.ts
 create mode 100644 libs/common/src/vault/models/data/ssh-key.data.ts
 create mode 100644 libs/common/src/vault/models/domain/ssh-key.spec.ts
 create mode 100644 libs/common/src/vault/models/domain/ssh-key.ts
 create mode 100644 libs/common/src/vault/models/view/ssh-key.view.ts
 create mode 100644 libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
 create mode 100644 libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
 create mode 100644 libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
 create mode 100644 libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts

diff --git a/apps/browser/src/_locales/en/messages.json b/apps/browser/src/_locales/en/messages.json
index b0df5fadd44..a1061e3d6e9 100644
--- a/apps/browser/src/_locales/en/messages.json
+++ b/apps/browser/src/_locales/en/messages.json
@@ -1593,6 +1593,9 @@
   "typeIdentity": {
     "message": "Identity"
   },
+  "typeSSHKey": {
+    "message": "SSH key"
+  },
   "newItemHeader": {
     "message": "New $TYPE$",
     "placeholders": {
@@ -4210,5 +4213,29 @@
   },
   "enterprisePolicyRequirementsApplied": {
     "message": "Enterprise policy requirements have been applied to this setting"
+  },
+  "sshPrivateKey": {
+    "message": "Private key"
+  },
+  "sshPublicKey": {
+    "message": "Public key"
+  },
+  "sshFingerprint": {
+    "message": "Fingerprint"
+  },
+  "sshKeyAlgorithm": {
+    "message": "Key type"
+  },
+  "sshKeyAlgorithmED25519": {
+    "message": "ED25519"
+  },
+  "sshKeyAlgorithmRSA2048": {
+    "message": "RSA 2048-Bit"
+  },
+  "sshKeyAlgorithmRSA3072": {
+    "message": "RSA 3072-Bit"
+  },
+  "sshKeyAlgorithmRSA4096": {
+    "message": "RSA 4096-Bit"
   }
 }
diff --git a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
index b830ae75048..006c5875ae2 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
@@ -300,6 +300,8 @@ export class AddEditV2Component implements OnInit {
         return this.i18nService.t(partOne, this.i18nService.t("typeIdentity"));
       case CipherType.SecureNote:
         return this.i18nService.t(partOne, this.i18nService.t("note"));
+      case CipherType.SSHKey:
+        return this.i18nService.t(partOne, this.i18nService.t("typeSSHKey"));
     }
   }
 }
diff --git a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
index 487168539b9..ca582a71bfb 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
@@ -82,3 +82,27 @@
     [cipher]="cipher"
   ></button>
 </bit-item-action>
+
+<bit-item-action *ngIf="cipher.type === CipherType.SSHKey">
+  <button
+    type="button"
+    bitIconButton="bwi-clone"
+    size="small"
+    [appA11yTitle]="
+      hasIdentityValues ? ('copyInfoTitle' | i18n: cipher.name) : ('noValuesToCopy' | i18n)
+    "
+    [disabled]="!hasIdentityValues"
+    [bitMenuTriggerFor]="identityOptions"
+  ></button>
+  <bit-menu #identityOptions>
+    <button type="button" bitMenuItem appCopyField="privateKey" [cipher]="cipher">
+      {{ "copyPrivateKey" | i18n }}
+    </button>
+    <button type="button" bitMenuItem appCopyField="publicKey" [cipher]="cipher">
+      {{ "copyPublicKey" | i18n }}
+    </button>
+    <button type="button" bitMenuItem appCopyField="keyFingerprint" [cipher]="cipher">
+      {{ "copyFingerprint" | i18n }}
+    </button>
+  </bit-menu>
+</bit-item-action>
diff --git a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts
index a53c4a7c355..2df705a7294 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts
@@ -48,5 +48,13 @@ export class ItemCopyActionsComponent {
     return !!this.cipher.notes;
   }
 
+  get hasSSHKeyValues() {
+    return (
+      !!this.cipher.sshKey.privateKey ||
+      !!this.cipher.sshKey.publicKey ||
+      !!this.cipher.sshKey.keyFingerprint
+    );
+  }
+
   constructor() {}
 }
diff --git a/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts b/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
index 9b8403cd319..1617c8fc9a9 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
@@ -100,6 +100,8 @@ export class ViewV2Component {
         );
       case CipherType.SecureNote:
         return this.i18nService.t("viewItemHeader", this.i18nService.t("note").toLowerCase());
+      case CipherType.SSHKey:
+        return this.i18nService.t("viewItemHeader", this.i18nService.t("typeSSHkey").toLowerCase());
     }
   }
 
diff --git a/apps/browser/src/vault/popup/components/vault/add-edit.component.html b/apps/browser/src/vault/popup/components/vault/add-edit.component.html
index 9ddae878770..cad3067a3ae 100644
--- a/apps/browser/src/vault/popup/components/vault/add-edit.component.html
+++ b/apps/browser/src/vault/popup/components/vault/add-edit.component.html
@@ -529,6 +529,14 @@ <h2 class="box-header">
             />
           </div>
         </div>
+
+        <!-- SSHKey -->
+        <div *ngIf="cipher.sshKey">
+          <div class="box-content-row" *ngIf="cipher.sshKey.privateKey" style="overflow: hidden">
+            <span class="row-label"> {{ "sshPrivateKey" | i18n }}</span>
+            {{ cipher.sshKey.privateKey }}
+          </div>
+        </div>
       </div>
     </div>
     <div class="box" *ngIf="cipher.type === cipherType.Login">
diff --git a/apps/browser/src/vault/popup/components/vault/vault-filter.component.html b/apps/browser/src/vault/popup/components/vault/vault-filter.component.html
index f9ae340a89b..7f0ef0f569c 100644
--- a/apps/browser/src/vault/popup/components/vault/vault-filter.component.html
+++ b/apps/browser/src/vault/popup/components/vault/vault-filter.component.html
@@ -114,6 +114,19 @@ <h2 class="box-header">
           <span class="row-sub-label">{{ typeCounts.get(cipherType.SecureNote) || 0 }}</span>
           <span><i class="bwi bwi-angle-right bwi-lg row-sub-icon"></i></span>
         </button>
+        <button
+          type="button"
+          class="box-content-row"
+          appStopClick
+          (click)="selectType(cipherType.SSHKey)"
+        >
+          <div class="row-main">
+            <div class="icon"><i class="bwi bwi-fw bwi-lg bwi-key"></i></div>
+            <span class="text">{{ "typeSSHKey" | i18n }}</span>
+          </div>
+          <span class="row-sub-label">{{ typeCounts.get(cipherType.SSHKey) || 0 }}</span>
+          <span><i class="bwi bwi-angle-right bwi-lg row-sub-icon"></i></span>
+        </button>
       </div>
     </div>
     <div class="box list" *ngIf="nestedFolders?.length">
diff --git a/apps/browser/src/vault/popup/components/vault/vault-items.component.ts b/apps/browser/src/vault/popup/components/vault/vault-items.component.ts
index df78806edf2..e360fb5971c 100644
--- a/apps/browser/src/vault/popup/components/vault/vault-items.component.ts
+++ b/apps/browser/src/vault/popup/components/vault/vault-items.component.ts
@@ -107,6 +107,9 @@ export class VaultItemsComponent extends BaseVaultItemsComponent implements OnIn
           case CipherType.SecureNote:
             this.groupingTitle = this.i18nService.t("secureNotes");
             break;
+          case CipherType.SSHKey:
+            this.groupingTitle = this.i18nService.t("sshKeys");
+            break;
           default:
             break;
         }
diff --git a/apps/browser/src/vault/popup/components/vault/view.component.html b/apps/browser/src/vault/popup/components/vault/view.component.html
index 606807140ec..640ac0d77e6 100644
--- a/apps/browser/src/vault/popup/components/vault/view.component.html
+++ b/apps/browser/src/vault/popup/components/vault/view.component.html
@@ -429,6 +429,29 @@ <h2 class="box-header">
           <div *ngIf="cipher.identity.country">{{ cipher.identity.country }}</div>
         </div>
       </div>
+      <!-- SSHKey -->
+      <div *ngIf="cipher.sshKey">
+        <div class="box-content-row" *ngIf="cipher.sshKey.publicKey" style="overflow: hidden">
+          <span
+            class="row-label draggable"
+            draggable="true"
+            (dragstart)="setTextDataOnDrag($event, cipher.sshKey.publicKey)"
+          >
+            {{ "sshPublicKey" | i18n }}</span
+          >
+          {{ cipher.sshKey.publicKey }}
+        </div>
+        <div class="box-content-row" *ngIf="cipher.sshKey.keyFingerprint" style="overflow: hidden">
+          <span
+            class="row-label draggable"
+            draggable="true"
+            (dragstart)="setTextDataOnDrag($event, cipher.sshKey.keyFingerprint)"
+          >
+            {{ "sshFingerprint" | i18n }}</span
+          >
+          {{ cipher.sshKey.keyFingerprint }}
+        </div>
+      </div>
     </div>
   </div>
   <div class="box" *ngIf="cipher.login && cipher.login.hasUris">
diff --git a/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts b/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
index 2ead93e5122..322f34aaa49 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
@@ -201,6 +201,7 @@ describe("VaultPopupItemsService", () => {
         [CipherType.Card]: 2,
         [CipherType.Identity]: 3,
         [CipherType.SecureNote]: 4,
+        [CipherType.SSHKey]: 5,
       };
 
       // Assume all ciphers are autofill ciphers to test sorting
diff --git a/apps/browser/src/vault/popup/services/vault-popup-items.service.ts b/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
index e78e289c75a..529de4d488c 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
@@ -257,6 +257,7 @@ export class VaultPopupItemsService {
       [CipherType.Card]: 2,
       [CipherType.Identity]: 3,
       [CipherType.SecureNote]: 4,
+      [CipherType.SSHKey]: 5,
     };
 
     // Compare types first
diff --git a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
index f6573de1c80..e416486728a 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
@@ -99,6 +99,7 @@ describe("VaultPopupListFiltersService", () => {
         CipherType.Card,
         CipherType.Identity,
         CipherType.SecureNote,
+        CipherType.SSHKey,
       ]);
     });
   });
diff --git a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
index 67213163a64..7cd5c6a0af3 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
@@ -165,6 +165,11 @@ export class VaultPopupListFiltersService {
       label: this.i18nService.t("note"),
       icon: "bwi-sticky-note",
     },
+    {
+      value: CipherType.SSHKey,
+      label: this.i18nService.t("typeSSHKey"),
+      icon: "bwi-key",
+    },
   ];
 
   /** Resets `filterForm` to the original state */
diff --git a/apps/desktop/src/locales/en/messages.json b/apps/desktop/src/locales/en/messages.json
index c0f98f17535..27e6a668ce9 100644
--- a/apps/desktop/src/locales/en/messages.json
+++ b/apps/desktop/src/locales/en/messages.json
@@ -26,6 +26,9 @@
   "typeSecureNote": {
     "message": "Secure note"
   },
+  "typeSSHKey": {
+    "message": "SSH key"
+  },
   "folders": {
     "message": "Folders"
   },
@@ -174,6 +177,30 @@
   "address": {
     "message": "Address"
   },
+  "sshPrivateKey": {
+    "message": "Private key"
+  },
+  "sshPublicKey": {
+    "message": "Public key"
+  },
+  "sshFingerprint": {
+    "message": "Fingerprint"
+  },
+  "sshKeyAlgorithm": {
+    "message": "Key type"
+  },
+  "sshKeyAlgorithmED25519": {
+    "message": "ED25519"
+  },
+  "sshKeyAlgorithmRSA2048": {
+    "message": "RSA 2048-Bit"
+  },
+  "sshKeyAlgorithmRSA3072": {
+    "message": "RSA 3072-Bit"
+  },
+  "sshKeyAlgorithmRSA4096": {
+    "message": "RSA 4096-Bit"
+  },
   "premiumRequired": {
     "message": "Premium required"
   },
diff --git a/apps/desktop/src/vault/app/vault/add-edit.component.html b/apps/desktop/src/vault/app/vault/add-edit.component.html
index faddd1210eb..cbc5504c28e 100644
--- a/apps/desktop/src/vault/app/vault/add-edit.component.html
+++ b/apps/desktop/src/vault/app/vault/add-edit.component.html
@@ -471,6 +471,44 @@ <h2 class="box-header">
               />
             </div>
           </div>
+          <!-- SSH Key -->
+          <div *ngIf="cipher.type === cipherType.SSHKey">
+            <div class="box-content-row box-content-row-flex" appBoxRow>
+              <div class="row-main">
+                <label for="sshPrivateKey">{{ "sshPrivateKey" | i18n }}</label>
+                <input
+                  id="sshPublicKey"
+                  type="{{ showPrivateKey ? 'text' : 'password' }}"
+                  name="SSHKey.SSHPrivateKey"
+                  [ngModel]="cipher.sshKey.privateKey"
+                  readonly
+                />
+              </div>
+              <div class="action-buttons">
+                <button
+                  type="button"
+                  class="row-btn"
+                  appStopClick
+                  (click)="copy(this.cipher.sshKey.privateKey, 'sshPrivateKey', 'SSHPrivateKey')"
+                >
+                  <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+                </button>
+                <button
+                  type="button"
+                  class="row-btn"
+                  appStopClick
+                  appA11yTitle="{{ 'toggleVisibility' | i18n }}"
+                  (click)="togglePrivateKey()"
+                >
+                  <i
+                    class="bwi bwi-lg"
+                    aria-hidden="true"
+                    [ngClass]="{ 'bwi-eye': !showPrivateKey, 'bwi-eye-slash': showPrivateKey }"
+                  ></i>
+                </button>
+              </div>
+            </div>
+          </div>
         </div>
       </div>
       <div class="box" *ngIf="cipher.type === cipherType.Login">
diff --git a/apps/desktop/src/vault/app/vault/add-edit.component.ts b/apps/desktop/src/vault/app/vault/add-edit.component.ts
index 098316de9ec..060471d5a5f 100644
--- a/apps/desktop/src/vault/app/vault/add-edit.component.ts
+++ b/apps/desktop/src/vault/app/vault/add-edit.component.ts
@@ -30,6 +30,8 @@ const BroadcasterSubscriptionId = "AddEditComponent";
 export class AddEditComponent extends BaseAddEditComponent implements OnInit, OnChanges, OnDestroy {
   @ViewChild("form")
   private form: NgForm;
+  showPrivateKey = false;
+
   constructor(
     cipherService: CipherService,
     folderService: FolderService,
@@ -137,4 +139,8 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On
       "https://bitwarden.com/help/managing-items/#protect-individual-items",
     );
   }
+
+  togglePrivateKey() {
+    this.showPrivateKey = !this.showPrivateKey;
+  }
 }
diff --git a/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html b/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html
index 381c06e8b67..55ae80eb593 100644
--- a/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html
+++ b/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html
@@ -79,4 +79,19 @@ <h2>
       </button>
     </span>
   </li>
+  <li
+    class="filter-option"
+    [ngClass]="{ active: activeFilter.cipherType === cipherTypeEnum.SSHKey }"
+  >
+    <span class="filter-buttons">
+      <button
+        type="button"
+        class="filter-button"
+        (click)="applyFilter(cipherTypeEnum.SSHKey)"
+        [attr.aria-pressed]="activeFilter.cipherType === cipherTypeEnum.SSHKey"
+      >
+        <i class="bwi bwi-fw bwi-key" aria-hidden="true"></i>&nbsp;{{ "typeSSHKey" | i18n }}
+      </button>
+    </span>
+  </li>
 </ul>
diff --git a/apps/desktop/src/vault/app/vault/view.component.html b/apps/desktop/src/vault/app/vault/view.component.html
index 1a85e7ef923..4e897c2b53d 100644
--- a/apps/desktop/src/vault/app/vault/view.component.html
+++ b/apps/desktop/src/vault/app/vault/view.component.html
@@ -399,6 +399,55 @@ <h2 class="box-header">
             <div *ngIf="cipher.identity.country">{{ cipher.identity.country }}</div>
           </div>
         </div>
+        <!-- SSH Key -->
+        <div *ngIf="cipher.sshKey">
+          <div class="box-content-row box-content-row-flex" appBoxRow>
+            <div class="row-main">
+              <label for="sshPublicKey">{{ "sshPublicKey" | i18n }}</label>
+              <input
+                id="sshPublicKey"
+                type="text"
+                name="SSHKey.SSHPublicKey"
+                [ngModel]="cipher.sshKey.publicKey"
+                readonly
+              />
+            </div>
+            <div class="action-buttons">
+              <button
+                type="button"
+                class="row-btn"
+                appStopClick
+                (click)="copy(cipher.sshKey.publicKey, 'sshPublicKey', 'SSHPublicKey')"
+                appA11yTitle="{{ 'generateSSHKey' | i18n }}"
+              >
+                <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+              </button>
+            </div>
+          </div>
+          <div class="box-content-row box-content-row-flex" appBoxRow>
+            <div class="row-main">
+              <label for="sshKeyFingerprint">{{ "sshFingerprint" | i18n }}</label>
+              <input
+                id="sshKeyFingerprint"
+                type="text"
+                name="SSHKey.SSHKeyFingerprint"
+                [ngModel]="cipher.sshKey.keyFingerprint"
+                readonly
+              />
+            </div>
+            <div class="action-buttons">
+              <button
+                type="button"
+                class="row-btn"
+                appStopClick
+                (click)="copy(cipher.sshKey.keyFingerprint, 'sshFingerprint', 'SSHFingerprint')"
+                appA11yTitle="{{ 'generateSSHKey' | i18n }}"
+              >
+                <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+              </button>
+            </div>
+          </div>
+        </div>
       </div>
     </div>
     <div class="box" *ngIf="cipher.login && cipher.login.hasUris">
diff --git a/apps/web/src/app/vault/individual-vault/add-edit.component.html b/apps/web/src/app/vault/individual-vault/add-edit.component.html
index 63136890071..82338caa1a6 100644
--- a/apps/web/src/app/vault/individual-vault/add-edit.component.html
+++ b/apps/web/src/app/vault/individual-vault/add-edit.component.html
@@ -847,6 +847,61 @@ <h1 class="modal-title" id="cipherAddEditTitle">{{ title }}</h1>
             </div>
           </div>
         </ng-container>
+        <!-- SSH Key -->
+        <ng-container *ngIf="cipher.type === cipherType.SSHKey">
+          <div class="row">
+            <div class="col-12 form-group">
+              <label for="sshKeyPublicKey">{{ "sshKeyPublicKey" | i18n }}</label>
+              <div class="input-group">
+                <input
+                  id="sshKeyPublicKey"
+                  class="form-control"
+                  type="text"
+                  name="SSHKey.PublicKey"
+                  [(ngModel)]="cipher.sshKey.publicKey"
+                  appInputVerbatim
+                  disabled
+                  readonly
+                />
+                <div class="input-group-append" *ngIf="!cipher.isDeleted">
+                  <button
+                    type="button"
+                    class="btn btn-outline-secondary"
+                    appA11yTitle="{{ 'copySSHPublicKey' | i18n }}"
+                    (click)="copy(cipher.sshKey.publicKey, 'sshKeyPublicKey', 'PublicKey')"
+                  >
+                    <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+                  </button>
+                </div>
+              </div>
+            </div>
+            <div class="col-12 form-group">
+              <label for="sshKeyFingerprint">{{ "sshKeyFingerprint" | i18n }}</label>
+              <div class="input-group">
+                <input
+                  id="sshKeyFingerprint"
+                  class="form-control"
+                  type="text"
+                  name="SSHKey.Fingerprint"
+                  [(ngModel)]="cipher.sshKey.keyFingerprint"
+                  appInputVerbatim
+                  disabled
+                  readonly
+                />
+                <div class="input-group-append" *ngIf="!cipher.isDeleted">
+                  <button
+                    type="button"
+                    class="btn btn-outline-secondary"
+                    appA11yTitle="{{ 'copySSHFingerprint' | i18n }}"
+                    (click)="copy(cipher.sshKey.keyFingerprint, 'sshKeyFingerprint', 'Fingerprint')"
+                  >
+                    <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+                  </button>
+                </div>
+              </div>
+            </div>
+          </div>
+        </ng-container>
         <div class="form-group">
           <label for="notes">{{ "notes" | i18n }}</label>
           <textarea
diff --git a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
index c9066ae66d2..afb6a0a4988 100644
--- a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
@@ -216,6 +216,12 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
         type: CipherType.SecureNote,
         icon: "bwi-sticky-note",
       },
+      {
+        id: "sshKey",
+        name: this.i18nService.t("typeSSHKey"),
+        type: CipherType.SSHKey,
+        icon: "bwi-key",
+      },
     ];
 
     const typeFilterSection: VaultFilterSection = {
diff --git a/apps/web/src/locales/en/messages.json b/apps/web/src/locales/en/messages.json
index f7899eae3a0..853211e0e0d 100644
--- a/apps/web/src/locales/en/messages.json
+++ b/apps/web/src/locales/en/messages.json
@@ -403,6 +403,9 @@
   "typeSecureNote": {
     "message": "Secure note"
   },
+  "typeSSHKey": {
+    "message": "SSH key"
+  },
   "typeLoginPlural": {
     "message": "Logins"
   },
@@ -8428,7 +8431,7 @@
   "deleteProviderRecoverConfirmDesc": {
     "message": "You have requested to delete this Provider. Use the button below to confirm."
   },
- "deleteProviderWarning": {
+  "deleteProviderWarning": {
     "message": "Deleting your provider is permanent. It cannot be undone."
   },
   "errorAssigningTargetCollection": {
@@ -8512,7 +8515,7 @@
   },
   "createdNewClient": {
     "message": "Successfully created new client"
-   },
+  },
   "noAccess": {
     "message": "No access"
   },
@@ -8948,5 +8951,26 @@
   },
   "additionalStorageGbMessage": {
     "message": "GB additional storage"
+  },
+  "sshKeyAlgorithm": {
+    "message": "Key algorithm"
+  },
+  "sshKeyFingerprint": {
+    "message": "Fingerprint"
+  },
+  "sshKeyPublicKey": {
+    "message": "Public key"
+  },
+  "sshKeyAlgorithmED25519": {
+    "message": "ED25519"
+  },
+  "sshKeyAlgorithmRSA2048": {
+    "message": "RSA 2048-Bit"
+  },
+  "sshKeyAlgorithmRSA3072": {
+    "message": "RSA 3072-Bit"
+  },
+  "sshKeyAlgorithmRSA4096": {
+    "message": "RSA 4096-Bit"
   }
 }
diff --git a/libs/angular/src/vault/components/add-edit.component.ts b/libs/angular/src/vault/components/add-edit.component.ts
index 909a905e9b0..59d179d48e7 100644
--- a/libs/angular/src/vault/components/add-edit.component.ts
+++ b/libs/angular/src/vault/components/add-edit.component.ts
@@ -37,6 +37,7 @@ import { IdentityView } from "@bitwarden/common/vault/models/view/identity.view"
 import { LoginUriView } from "@bitwarden/common/vault/models/view/login-uri.view";
 import { LoginView } from "@bitwarden/common/vault/models/view/login.view";
 import { SecureNoteView } from "@bitwarden/common/vault/models/view/secure-note.view";
+import { SSHKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
 import { DialogService } from "@bitwarden/components";
 import { PasswordRepromptService } from "@bitwarden/vault";
 
@@ -128,6 +129,7 @@ export class AddEditComponent implements OnInit, OnDestroy {
       { name: i18nService.t("typeIdentity"), value: CipherType.Identity },
       { name: i18nService.t("typeSecureNote"), value: CipherType.SecureNote },
     ];
+
     this.cardBrandOptions = [
       { name: "-- " + i18nService.t("select") + " --", value: null },
       { name: "Visa", value: "Visa" },
@@ -277,6 +279,7 @@ export class AddEditComponent implements OnInit, OnDestroy {
         this.cipher.identity = new IdentityView();
         this.cipher.secureNote = new SecureNoteView();
         this.cipher.secureNote.type = SecureNoteType.Generic;
+        this.cipher.sshKey = new SSHKeyView();
         this.cipher.reprompt = CipherRepromptType.None;
       }
     }
diff --git a/libs/common/src/vault/enums/cipher-type.ts b/libs/common/src/vault/enums/cipher-type.ts
index cce7874d667..fab3e98dc6f 100644
--- a/libs/common/src/vault/enums/cipher-type.ts
+++ b/libs/common/src/vault/enums/cipher-type.ts
@@ -3,4 +3,5 @@ export enum CipherType {
   SecureNote = 2,
   Card = 3,
   Identity = 4,
+  SSHKey = 5,
 }
diff --git a/libs/common/src/vault/icon/build-cipher-icon.ts b/libs/common/src/vault/icon/build-cipher-icon.ts
index 9e6e671f44d..29ba401c837 100644
--- a/libs/common/src/vault/icon/build-cipher-icon.ts
+++ b/libs/common/src/vault/icon/build-cipher-icon.ts
@@ -67,6 +67,9 @@ export function buildCipherIcon(iconsServerUrl: string, cipher: CipherView, show
     case CipherType.Identity:
       icon = "bwi-id-card";
       break;
+    case CipherType.SSHKey:
+      icon = "bwi-key";
+      break;
     default:
       break;
   }
diff --git a/libs/common/src/vault/models/api/ssh-key.api.ts b/libs/common/src/vault/models/api/ssh-key.api.ts
new file mode 100644
index 00000000000..e248408424f
--- /dev/null
+++ b/libs/common/src/vault/models/api/ssh-key.api.ts
@@ -0,0 +1,17 @@
+import { BaseResponse } from "../../../models/response/base.response";
+
+export class SSHKeyApi extends BaseResponse {
+  privateKey: string;
+  publicKey: string;
+  keyFingerprint: string;
+
+  constructor(data: any = null) {
+    super(data);
+    if (data == null) {
+      return;
+    }
+    this.privateKey = this.getResponseProperty("PrivateKey");
+    this.publicKey = this.getResponseProperty("PublicKey");
+    this.keyFingerprint = this.getResponseProperty("KeyFingerprint");
+  }
+}
diff --git a/libs/common/src/vault/models/data/cipher.data.ts b/libs/common/src/vault/models/data/cipher.data.ts
index f8db7186d61..22bb3e8be84 100644
--- a/libs/common/src/vault/models/data/cipher.data.ts
+++ b/libs/common/src/vault/models/data/cipher.data.ts
@@ -11,6 +11,7 @@ import { IdentityData } from "./identity.data";
 import { LoginData } from "./login.data";
 import { PasswordHistoryData } from "./password-history.data";
 import { SecureNoteData } from "./secure-note.data";
+import { SSHKeyData } from "./ssh-key.data";
 
 export class CipherData {
   id: string;
@@ -28,6 +29,7 @@ export class CipherData {
   secureNote?: SecureNoteData;
   card?: CardData;
   identity?: IdentityData;
+  sshKey?: SSHKeyData;
   fields?: FieldData[];
   attachments?: AttachmentData[];
   passwordHistory?: PasswordHistoryData[];
@@ -72,6 +74,9 @@ export class CipherData {
       case CipherType.Identity:
         this.identity = new IdentityData(response.identity);
         break;
+      case CipherType.SSHKey:
+        this.sshKey = new SSHKeyData(response.sshKey);
+        break;
       default:
         break;
     }
diff --git a/libs/common/src/vault/models/data/ssh-key.data.ts b/libs/common/src/vault/models/data/ssh-key.data.ts
new file mode 100644
index 00000000000..50eefd98dea
--- /dev/null
+++ b/libs/common/src/vault/models/data/ssh-key.data.ts
@@ -0,0 +1,17 @@
+import { SSHKeyApi } from "../api/ssh-key.api";
+
+export class SSHKeyData {
+  privateKey: string;
+  publicKey: string;
+  keyFingerprint: string;
+
+  constructor(data?: SSHKeyApi) {
+    if (data == null) {
+      return;
+    }
+
+    this.privateKey = data.privateKey;
+    this.publicKey = data.publicKey;
+    this.keyFingerprint = data.keyFingerprint;
+  }
+}
diff --git a/libs/common/src/vault/models/domain/cipher.ts b/libs/common/src/vault/models/domain/cipher.ts
index 475c9337525..3b22394abf0 100644
--- a/libs/common/src/vault/models/domain/cipher.ts
+++ b/libs/common/src/vault/models/domain/cipher.ts
@@ -19,6 +19,7 @@ import { Identity } from "./identity";
 import { Login } from "./login";
 import { Password } from "./password";
 import { SecureNote } from "./secure-note";
+import { SSHKey } from "./ssh-key";
 
 export class Cipher extends Domain implements Decryptable<CipherView> {
   readonly initializerKey = InitializerKey.Cipher;
@@ -39,6 +40,7 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
   identity: Identity;
   card: Card;
   secureNote: SecureNote;
+  sshKey: SSHKey;
   attachments: Attachment[];
   fields: Field[];
   passwordHistory: Password[];
@@ -97,6 +99,9 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.Identity:
         this.identity = new Identity(obj.identity);
         break;
+      case CipherType.SSHKey:
+        this.sshKey = new SSHKey(obj.sshKey);
+        break;
       default:
         break;
     }
@@ -156,6 +161,9 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.Identity:
         model.identity = await this.identity.decrypt(this.organizationId, encKey);
         break;
+      case CipherType.SSHKey:
+        model.sshKey = await this.sshKey.decrypt(this.organizationId, encKey);
+        break;
       default:
         break;
     }
@@ -240,6 +248,9 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.Identity:
         c.identity = this.identity.toIdentityData();
         break;
+      case CipherType.SSHKey:
+        c.sshKey = this.sshKey.toSSHKeyData();
+        break;
       default:
         break;
     }
@@ -295,6 +306,9 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.SecureNote:
         domain.secureNote = SecureNote.fromJSON(obj.secureNote);
         break;
+      case CipherType.SSHKey:
+        domain.sshKey = SSHKey.fromJSON(obj.sshKey);
+        break;
       default:
         break;
     }
diff --git a/libs/common/src/vault/models/domain/ssh-key.spec.ts b/libs/common/src/vault/models/domain/ssh-key.spec.ts
new file mode 100644
index 00000000000..32ae2701928
--- /dev/null
+++ b/libs/common/src/vault/models/domain/ssh-key.spec.ts
@@ -0,0 +1,67 @@
+import { mockEnc } from "../../../../spec";
+import { SSHKeyApi } from "../api/ssh-key.api";
+import { SSHKeyData } from "../data/ssh-key.data";
+
+import { SSHKey } from "./ssh-key";
+
+describe("SSHkey", () => {
+  let data: SSHKeyData;
+
+  beforeEach(() => {
+    data = new SSHKeyData(
+      new SSHKeyApi({
+        PrivateKey: "privateKey",
+        PublicKey: "publicKey",
+        KeyFingerprint: "keyFingerprint",
+      }),
+    );
+  });
+
+  it("Convert", () => {
+    const sshKey = new SSHKey(data);
+
+    expect(sshKey).toEqual({
+      privateKey: { encryptedString: "privateKey", encryptionType: 0 },
+      publicKey: { encryptedString: "publicKey", encryptionType: 0 },
+      keyFingerprint: { encryptedString: "keyFingerprint", encryptionType: 0 },
+    });
+  });
+
+  it("Convert from empty", () => {
+    const data = new SSHKeyData();
+    const sshKey = new SSHKey(data);
+
+    expect(sshKey).toEqual({
+      privateKey: null,
+      publicKey: null,
+      keyFingerprint: null,
+    });
+  });
+
+  it("toSSHKeyData", () => {
+    const sshKey = new SSHKey(data);
+    expect(sshKey.toSSHKeyData()).toEqual(data);
+  });
+
+  it("Decrypt", async () => {
+    const sshKey = Object.assign(new SSHKey(), {
+      privateKey: mockEnc("privateKey"),
+      publicKey: mockEnc("publicKey"),
+      keyFingerprint: mockEnc("keyFingerprint"),
+    });
+    const expectedView = {
+      privateKey: "privateKey",
+      publicKey: "publicKey",
+      keyFingerprint: "keyFingerprint",
+    };
+
+    const loginView = await sshKey.decrypt(null);
+    expect(loginView).toEqual(expectedView);
+  });
+
+  describe("fromJSON", () => {
+    it("returns null if object is null", () => {
+      expect(SSHKey.fromJSON(null)).toBeNull();
+    });
+  });
+});
diff --git a/libs/common/src/vault/models/domain/ssh-key.ts b/libs/common/src/vault/models/domain/ssh-key.ts
new file mode 100644
index 00000000000..6c893008ecc
--- /dev/null
+++ b/libs/common/src/vault/models/domain/ssh-key.ts
@@ -0,0 +1,70 @@
+import { Jsonify } from "type-fest";
+
+import { EncString } from "@bitwarden/common/platform/models/domain/enc-string";
+
+import Domain from "../../../platform/models/domain/domain-base";
+import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key";
+import { SSHKeyData } from "../data/ssh-key.data";
+import { SSHKeyView } from "../view/ssh-key.view";
+
+export class SSHKey extends Domain {
+  privateKey: EncString;
+  publicKey: EncString;
+  keyFingerprint: EncString;
+
+  constructor(obj?: SSHKeyData) {
+    super();
+    if (obj == null) {
+      return;
+    }
+
+    this.buildDomainModel(
+      this,
+      obj,
+      {
+        privateKey: null,
+        publicKey: null,
+        keyFingerprint: null,
+      },
+      [],
+    );
+  }
+
+  decrypt(orgId: string, encKey?: SymmetricCryptoKey): Promise<SSHKeyView> {
+    return this.decryptObj(
+      new SSHKeyView(),
+      {
+        privateKey: null,
+        publicKey: null,
+        keyFingerprint: null,
+      },
+      orgId,
+      encKey,
+    );
+  }
+
+  toSSHKeyData(): SSHKeyData {
+    const c = new SSHKeyData();
+    this.buildDataModel(this, c, {
+      privateKey: null,
+      publicKey: null,
+      keyFingerprint: null,
+    });
+    return c;
+  }
+
+  static fromJSON(obj: Partial<Jsonify<SSHKey>>): SSHKey {
+    if (obj == null) {
+      return null;
+    }
+
+    const privateKey = EncString.fromJSON(obj.privateKey);
+    const publicKey = EncString.fromJSON(obj.publicKey);
+    const keyFingerprint = EncString.fromJSON(obj.keyFingerprint);
+    return Object.assign(new SSHKey(), obj, {
+      privateKey,
+      publicKey,
+      keyFingerprint,
+    });
+  }
+}
diff --git a/libs/common/src/vault/models/request/cipher.request.ts b/libs/common/src/vault/models/request/cipher.request.ts
index 52a55b6c3e4..532df558c6b 100644
--- a/libs/common/src/vault/models/request/cipher.request.ts
+++ b/libs/common/src/vault/models/request/cipher.request.ts
@@ -7,6 +7,7 @@ import { IdentityApi } from "../api/identity.api";
 import { LoginUriApi } from "../api/login-uri.api";
 import { LoginApi } from "../api/login.api";
 import { SecureNoteApi } from "../api/secure-note.api";
+import { SSHKeyApi } from "../api/ssh-key.api";
 import { Cipher } from "../domain/cipher";
 
 import { AttachmentRequest } from "./attachment.request";
@@ -23,6 +24,7 @@ export class CipherRequest {
   secureNote: SecureNoteApi;
   card: CardApi;
   identity: IdentityApi;
+  sshKey: SSHKeyApi;
   fields: FieldApi[];
   passwordHistory: PasswordHistoryRequest[];
   // Deprecated, remove at some point and rename attachments2 to attachments
@@ -93,6 +95,17 @@ export class CipherRequest {
         this.secureNote = new SecureNoteApi();
         this.secureNote.type = cipher.secureNote.type;
         break;
+      case CipherType.SSHKey:
+        this.sshKey = new SSHKeyApi();
+        this.sshKey.privateKey =
+          cipher.sshKey.privateKey != null ? cipher.sshKey.privateKey.encryptedString : null;
+        this.sshKey.publicKey =
+          cipher.sshKey.publicKey != null ? cipher.sshKey.publicKey.encryptedString : null;
+        this.sshKey.keyFingerprint =
+          cipher.sshKey.keyFingerprint != null
+            ? cipher.sshKey.keyFingerprint.encryptedString
+            : null;
+        break;
       case CipherType.Card:
         this.card = new CardApi();
         this.card.cardholderName =
diff --git a/libs/common/src/vault/models/response/cipher.response.ts b/libs/common/src/vault/models/response/cipher.response.ts
index 67709b602e3..20b0d5d272f 100644
--- a/libs/common/src/vault/models/response/cipher.response.ts
+++ b/libs/common/src/vault/models/response/cipher.response.ts
@@ -5,6 +5,7 @@ import { FieldApi } from "../api/field.api";
 import { IdentityApi } from "../api/identity.api";
 import { LoginApi } from "../api/login.api";
 import { SecureNoteApi } from "../api/secure-note.api";
+import { SSHKeyApi } from "../api/ssh-key.api";
 
 import { AttachmentResponse } from "./attachment.response";
 import { PasswordHistoryResponse } from "./password-history.response";
@@ -21,6 +22,7 @@ export class CipherResponse extends BaseResponse {
   card: CardApi;
   identity: IdentityApi;
   secureNote: SecureNoteApi;
+  sshKey: SSHKeyApi;
   favorite: boolean;
   edit: boolean;
   viewPassword: boolean;
@@ -75,6 +77,11 @@ export class CipherResponse extends BaseResponse {
       this.secureNote = new SecureNoteApi(secureNote);
     }
 
+    const sshKey = this.getResponseProperty("sshKey");
+    if (sshKey != null) {
+      this.sshKey = new SSHKeyApi(sshKey);
+    }
+
     const fields = this.getResponseProperty("Fields");
     if (fields != null) {
       this.fields = fields.map((f: any) => new FieldApi(f));
diff --git a/libs/common/src/vault/models/view/cipher.view.ts b/libs/common/src/vault/models/view/cipher.view.ts
index 028b582db26..3ab5b29f580 100644
--- a/libs/common/src/vault/models/view/cipher.view.ts
+++ b/libs/common/src/vault/models/view/cipher.view.ts
@@ -15,6 +15,7 @@ import { IdentityView } from "./identity.view";
 import { LoginView } from "./login.view";
 import { PasswordHistoryView } from "./password-history.view";
 import { SecureNoteView } from "./secure-note.view";
+import { SSHKeyView } from "./ssh-key.view";
 
 export class CipherView implements View, InitializerMetadata {
   readonly initializerKey = InitializerKey.CipherView;
@@ -34,6 +35,7 @@ export class CipherView implements View, InitializerMetadata {
   identity = new IdentityView();
   card = new CardView();
   secureNote = new SecureNoteView();
+  sshKey = new SSHKeyView();
   attachments: AttachmentView[] = null;
   fields: FieldView[] = null;
   passwordHistory: PasswordHistoryView[] = null;
@@ -75,6 +77,8 @@ export class CipherView implements View, InitializerMetadata {
         return this.card;
       case CipherType.Identity:
         return this.identity;
+      case CipherType.SSHKey:
+        return this.sshKey;
       default:
         break;
     }
@@ -184,6 +188,9 @@ export class CipherView implements View, InitializerMetadata {
       case CipherType.SecureNote:
         view.secureNote = SecureNoteView.fromJSON(obj.secureNote);
         break;
+      case CipherType.SSHKey:
+        view.sshKey = SSHKeyView.fromJSON(obj.sshKey);
+        break;
       default:
         break;
     }
diff --git a/libs/common/src/vault/models/view/ssh-key.view.ts b/libs/common/src/vault/models/view/ssh-key.view.ts
new file mode 100644
index 00000000000..f3547254a51
--- /dev/null
+++ b/libs/common/src/vault/models/view/ssh-key.view.ts
@@ -0,0 +1,26 @@
+import { Jsonify } from "type-fest";
+
+import { SSHKey } from "../domain/ssh-key";
+
+import { ItemView } from "./item.view";
+
+export class SSHKeyView extends ItemView {
+  privateKey: string = null;
+  publicKey: string = null;
+  keyFingerprint: string = null;
+
+  constructor(n?: SSHKey) {
+    super();
+    if (!n) {
+      return;
+    }
+  }
+
+  get subTitle(): string {
+    return null;
+  }
+
+  static fromJSON(obj: Partial<Jsonify<SSHKeyView>>): SSHKeyView {
+    return Object.assign(new SSHKeyView(), obj);
+  }
+}
diff --git a/libs/common/src/vault/services/cipher.service.ts b/libs/common/src/vault/services/cipher.service.ts
index 92676aea97b..739bb084c74 100644
--- a/libs/common/src/vault/services/cipher.service.ts
+++ b/libs/common/src/vault/services/cipher.service.ts
@@ -50,6 +50,7 @@ import { LoginUri } from "../models/domain/login-uri";
 import { Password } from "../models/domain/password";
 import { SecureNote } from "../models/domain/secure-note";
 import { SortedCiphersCache } from "../models/domain/sorted-ciphers-cache";
+import { SSHKey } from "../models/domain/ssh-key";
 import { CipherBulkDeleteRequest } from "../models/request/cipher-bulk-delete.request";
 import { CipherBulkMoveRequest } from "../models/request/cipher-bulk-move.request";
 import { CipherBulkRestoreRequest } from "../models/request/cipher-bulk-restore.request";
@@ -1542,6 +1543,19 @@ export class CipherService implements CipherServiceAbstraction {
           key,
         );
         return;
+      case CipherType.SSHKey:
+        cipher.sshKey = new SSHKey();
+        await this.encryptObjProperty(
+          model.sshKey,
+          cipher.sshKey,
+          {
+            privateKey: null,
+            publicKey: null,
+            keyFingerprint: null,
+          },
+          key,
+        );
+        return;
       default:
         throw new Error("Unknown cipher type.");
     }
diff --git a/libs/vault/src/cipher-form/cipher-form-container.ts b/libs/vault/src/cipher-form/cipher-form-container.ts
index 87495df643f..60381df7297 100644
--- a/libs/vault/src/cipher-form/cipher-form-container.ts
+++ b/libs/vault/src/cipher-form/cipher-form-container.ts
@@ -8,6 +8,7 @@ import { CustomFieldsComponent } from "./components/custom-fields/custom-fields.
 import { IdentitySectionComponent } from "./components/identity/identity.component";
 import { ItemDetailsSectionComponent } from "./components/item-details/item-details-section.component";
 import { LoginDetailsSectionComponent } from "./components/login-details-section/login-details-section.component";
+import { SSHKeySectionComponent } from "./components/sshkey-section/sshkey-section.component";
 
 /**
  * The complete form for a cipher. Includes all the sub-forms from their respective section components.
@@ -20,6 +21,7 @@ export type CipherForm = {
   autoFillOptions?: AutofillOptionsComponent["autofillOptionsForm"];
   cardDetails?: CardDetailsSectionComponent["cardDetailsForm"];
   identityDetails?: IdentitySectionComponent["identityForm"];
+  sshKeyDetails?: SSHKeySectionComponent["sshKeyForm"];
   customFields?: CustomFieldsComponent["customFieldsForm"];
 };
 
diff --git a/libs/vault/src/cipher-form/components/cipher-form.component.html b/libs/vault/src/cipher-form/components/cipher-form.component.html
index 60dbd91fc36..717b9a318ac 100644
--- a/libs/vault/src/cipher-form/components/cipher-form.component.html
+++ b/libs/vault/src/cipher-form/components/cipher-form.component.html
@@ -22,6 +22,12 @@
       [disabled]="config.mode === 'partial-edit'"
     ></vault-card-details-section>
 
+    <vault-sshkey-section
+      *ngIf="config.cipherType === CipherType.SSHKey"
+      [disabled]="config.mode === 'partial-edit'"
+      [originalCipherView]="originalCipherView"
+    ></vault-sshkey-section>
+
     <vault-additional-options-section></vault-additional-options-section>
 
     <!-- Attachments are only available for existing ciphers -->
diff --git a/libs/vault/src/cipher-form/components/cipher-form.component.ts b/libs/vault/src/cipher-form/components/cipher-form.component.ts
index 2a65218e82d..b9ec4672b5a 100644
--- a/libs/vault/src/cipher-form/components/cipher-form.component.ts
+++ b/libs/vault/src/cipher-form/components/cipher-form.component.ts
@@ -40,6 +40,7 @@ import { CardDetailsSectionComponent } from "./card-details-section/card-details
 import { IdentitySectionComponent } from "./identity/identity.component";
 import { ItemDetailsSectionComponent } from "./item-details/item-details-section.component";
 import { LoginDetailsSectionComponent } from "./login-details-section/login-details-section.component";
+import { SSHKeySectionComponent } from "./sshkey-section/sshkey-section.component";
 
 @Component({
   selector: "vault-cipher-form",
@@ -63,6 +64,7 @@ import { LoginDetailsSectionComponent } from "./login-details-section/login-deta
     ItemDetailsSectionComponent,
     CardDetailsSectionComponent,
     IdentitySectionComponent,
+    SSHKeySectionComponent,
     NgIf,
     AdditionalOptionsSectionComponent,
     LoginDetailsSectionComponent,
diff --git a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
new file mode 100644
index 00000000000..4c85ce782e2
--- /dev/null
+++ b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
@@ -0,0 +1,18 @@
+<bit-section [formGroup]="sshKeyForm">
+  <bit-section-header>
+    <h2 bitTypography="h6">
+      {{ "typeSSHKey" | i18n }}
+    </h2>
+  </bit-section-header>
+  <bit-card>
+    <bit-form-field>
+      <bit-label>{{ "sshPublicKey" | i18n }}</bit-label>
+      <input id="publicKey" bitInput formControlName="publicKey" />
+    </bit-form-field>
+
+    <bit-form-field>
+      <bit-label>{{ "sshFingerprint" | i18n }}</bit-label>
+      <input id="keyFingerprint" bitInput formControlName="keyFingerprint" />
+    </bit-form-field>
+  </bit-card>
+</bit-section>
diff --git a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
new file mode 100644
index 00000000000..ab82fee26b9
--- /dev/null
+++ b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
@@ -0,0 +1,80 @@
+import { CommonModule } from "@angular/common";
+import { Component, Input, OnInit } from "@angular/core";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
+import {
+  CardComponent,
+  FormFieldModule,
+  IconButtonModule,
+  SectionComponent,
+  SectionHeaderComponent,
+  SelectModule,
+  TypographyModule,
+} from "@bitwarden/components";
+
+import { CipherFormContainer } from "../../cipher-form-container";
+
+@Component({
+  selector: "vault-sshkey-section",
+  templateUrl: "./sshkey-section.component.html",
+  standalone: true,
+  imports: [
+    CardComponent,
+    SectionComponent,
+    TypographyModule,
+    FormFieldModule,
+    ReactiveFormsModule,
+    SelectModule,
+    SectionHeaderComponent,
+    IconButtonModule,
+    JslibModule,
+    CommonModule,
+  ],
+})
+export class SSHKeySectionComponent implements OnInit {
+  /** The original cipher */
+  @Input() originalCipherView: CipherView;
+
+  /** True when all fields should be disabled */
+  @Input() disabled: boolean;
+
+  /**
+   * All form fields associated with the ssh key
+   *
+   * Note: `as` is used to assert the type of the form control,
+   * leaving as just null gets inferred as `unknown`
+   */
+  sshKeyForm = this.formBuilder.group({
+    privateKey: null as string | null,
+    publicKey: null as string | null,
+    keyFingerprint: null as string | null,
+  });
+
+  constructor(
+    private cipherFormContainer: CipherFormContainer,
+    private formBuilder: FormBuilder,
+    private i18nService: I18nService,
+  ) {}
+
+  ngOnInit() {
+    if (this.originalCipherView?.card) {
+      this.setInitialValues();
+    }
+
+    this.sshKeyForm.disable();
+  }
+
+  /** Set form initial form values from the current cipher */
+  private setInitialValues() {
+    const { privateKey, publicKey, keyFingerprint } = this.originalCipherView.sshKey;
+
+    this.sshKeyForm.setValue({
+      privateKey,
+      publicKey,
+      keyFingerprint,
+    });
+  }
+}
diff --git a/libs/vault/src/cipher-view/cipher-view.component.html b/libs/vault/src/cipher-view/cipher-view.component.html
index 68c80a7bd52..6c8fc46715d 100644
--- a/libs/vault/src/cipher-view/cipher-view.component.html
+++ b/libs/vault/src/cipher-view/cipher-view.component.html
@@ -22,6 +22,9 @@
   <app-view-identity-sections *ngIf="cipher.identity" [cipher]="cipher">
   </app-view-identity-sections>
 
+  <!-- SSHKEY SECTIONS -->
+  <app-sshkey-view *ngIf="hasSshKey" [sshKey]="cipher.sshKey"></app-sshkey-view>
+
   <!-- ADDITIONAL OPTIONS -->
   <ng-container *ngIf="cipher.notes">
     <app-additional-options [notes]="cipher.notes"> </app-additional-options>
diff --git a/libs/vault/src/cipher-view/cipher-view.component.ts b/libs/vault/src/cipher-view/cipher-view.component.ts
index 092b7dba396..accd95ca7d4 100644
--- a/libs/vault/src/cipher-view/cipher-view.component.ts
+++ b/libs/vault/src/cipher-view/cipher-view.component.ts
@@ -21,6 +21,7 @@ import { CustomFieldV2Component } from "./custom-fields/custom-fields-v2.compone
 import { ItemDetailsV2Component } from "./item-details/item-details-v2.component";
 import { ItemHistoryV2Component } from "./item-history/item-history-v2.component";
 import { LoginCredentialsViewComponent } from "./login-credentials/login-credentials-view.component";
+import { SSHKeyViewComponent } from "./sshkey-sections/sshkey-view.component";
 import { ViewIdentitySectionsComponent } from "./view-identity-sections/view-identity-sections.component";
 
 @Component({
@@ -37,6 +38,7 @@ import { ViewIdentitySectionsComponent } from "./view-identity-sections/view-ide
     ItemHistoryV2Component,
     CustomFieldV2Component,
     CardDetailsComponent,
+    SSHKeyViewComponent,
     ViewIdentitySectionsComponent,
     LoginCredentialsViewComponent,
     AutofillOptionsViewComponent,
@@ -78,6 +80,10 @@ export class CipherViewComponent implements OnInit, OnDestroy {
     return this.cipher.login?.uris.length > 0;
   }
 
+  get hasSshKey() {
+    return this.cipher.sshKey?.privateKey;
+  }
+
   async loadCipherData() {
     if (this.cipher.collectionIds.length > 0) {
       this.collections$ = this.collectionService
diff --git a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
new file mode 100644
index 00000000000..4f8159c2915
--- /dev/null
+++ b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
@@ -0,0 +1,31 @@
+<bit-section>
+  <bit-section-header>
+    <h2 bitTypography="h6">{{ "typeSSHKey" | i18n }}</h2>
+  </bit-section-header>
+  <bit-card class="[&_bit-form-field:last-of-type]:tw-mb-0">
+    <bit-form-field>
+      <bit-label>{{ "sshPublicKey" | i18n }}</bit-label>
+      <input readonly bitInput [value]="sshKey.publicKey" aria-readonly="true" />
+      <button
+        bitIconButton="bwi-clone"
+        bitSuffix
+        type="button"
+        [appCopyClick]="sshKey.publicKey"
+        showToast
+        [appA11yTitle]="'copyValue' | i18n"
+      ></button>
+    </bit-form-field>
+    <bit-form-field>
+      <bit-label>{{ "sshFingerprint" | i18n }}</bit-label>
+      <input readonly bitInput [value]="sshKey.keyFingerprint" aria-readonly="true" />
+      <button
+        bitIconButton="bwi-clone"
+        bitSuffix
+        type="button"
+        [appCopyClick]="sshKey.keyFingerprint"
+        showToast
+        [appA11yTitle]="'copyValue' | i18n"
+      ></button>
+    </bit-form-field>
+  </bit-card>
+</bit-section>
diff --git a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts
new file mode 100644
index 00000000000..75b1975cab2
--- /dev/null
+++ b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts
@@ -0,0 +1,35 @@
+import { CommonModule } from "@angular/common";
+import { Component, Input } from "@angular/core";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { SSHKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
+import {
+  CardComponent,
+  SectionComponent,
+  SectionHeaderComponent,
+  TypographyModule,
+  FormFieldModule,
+  IconButtonModule,
+} from "@bitwarden/components";
+
+import { OrgIconDirective } from "../../components/org-icon.directive";
+
+@Component({
+  selector: "app-sshkey-view",
+  templateUrl: "sshkey-view.component.html",
+  standalone: true,
+  imports: [
+    CommonModule,
+    JslibModule,
+    CardComponent,
+    SectionComponent,
+    SectionHeaderComponent,
+    TypographyModule,
+    OrgIconDirective,
+    FormFieldModule,
+    IconButtonModule,
+  ],
+})
+export class SSHKeyViewComponent {
+  @Input() sshKey: SSHKeyView;
+}
diff --git a/libs/vault/src/components/copy-cipher-field.directive.ts b/libs/vault/src/components/copy-cipher-field.directive.ts
index 7d842c36bfe..e03419815bf 100644
--- a/libs/vault/src/components/copy-cipher-field.directive.ts
+++ b/libs/vault/src/components/copy-cipher-field.directive.ts
@@ -91,6 +91,12 @@ export class CopyCipherFieldDirective implements OnChanges {
         return this.cipher.identity?.fullAddressForCopy;
       case "secureNote":
         return this.cipher.notes;
+      case "privateKey":
+        return this.cipher.sshKey?.privateKey;
+      case "publicKey":
+        return this.cipher.sshKey?.publicKey;
+      case "keyFingerprint":
+        return this.cipher.sshKey?.keyFingerprint;
       default:
         return null;
     }
diff --git a/libs/vault/src/services/copy-cipher-field.service.ts b/libs/vault/src/services/copy-cipher-field.service.ts
index 372409b8e97..33bba16e169 100644
--- a/libs/vault/src/services/copy-cipher-field.service.ts
+++ b/libs/vault/src/services/copy-cipher-field.service.ts
@@ -25,7 +25,10 @@ export type CopyAction =
   | "phone"
   | "address"
   | "secureNote"
-  | "hiddenField";
+  | "hiddenField"
+  | "privateKey"
+  | "publicKey"
+  | "keyFingerprint";
 
 type CopyActionInfo = {
   /**
@@ -62,6 +65,9 @@ const CopyActions: Record<CopyAction, CopyActionInfo> = {
   phone: { typeI18nKey: "phone", protected: true },
   address: { typeI18nKey: "address", protected: true },
   secureNote: { typeI18nKey: "note", protected: true },
+  privateKey: { typeI18nKey: "sshPrivateKey", protected: true },
+  publicKey: { typeI18nKey: "sshPublicKey", protected: true },
+  keyFingerprint: { typeI18nKey: "sshFingerprint", protected: true },
   hiddenField: {
     typeI18nKey: "value",
     protected: true,

From a7b608477ee03b7835936a5fd315189e3b0dc3e8 Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Fri, 30 Aug 2024 16:31:10 +0200
Subject: [PATCH 2/8] [PM-10399] Add ssh key import export for bitwarden json
 (#10529)

* Add ssh key import export for bitwarden json

* Remove key type from ssh key export
---
 .../common/src/models/export/cipher.export.ts | 11 +++++
 .../src/models/export/ssh-key.export.ts       | 44 +++++++++++++++++++
 .../dialog/import-success-dialog.component.ts |  7 +++
 3 files changed, 62 insertions(+)
 create mode 100644 libs/common/src/models/export/ssh-key.export.ts

diff --git a/libs/common/src/models/export/cipher.export.ts b/libs/common/src/models/export/cipher.export.ts
index 64583f7fcef..b5654f38b52 100644
--- a/libs/common/src/models/export/cipher.export.ts
+++ b/libs/common/src/models/export/cipher.export.ts
@@ -10,6 +10,7 @@ import { IdentityExport } from "./identity.export";
 import { LoginExport } from "./login.export";
 import { PasswordHistoryExport } from "./password-history.export";
 import { SecureNoteExport } from "./secure-note.export";
+import { SSHKeyExport } from "./ssh-key.export";
 import { safeGetString } from "./utils";
 
 export class CipherExport {
@@ -27,6 +28,7 @@ export class CipherExport {
     req.secureNote = null;
     req.card = null;
     req.identity = null;
+    req.sshKey = null;
     req.reprompt = CipherRepromptType.None;
     req.passwordHistory = [];
     req.creationDate = null;
@@ -67,6 +69,8 @@ export class CipherExport {
       case CipherType.Identity:
         view.identity = IdentityExport.toView(req.identity);
         break;
+      case CipherType.SSHKey:
+        view.sshKey = SSHKeyExport.toView(req.sshKey);
     }
 
     if (req.passwordHistory != null) {
@@ -108,6 +112,9 @@ export class CipherExport {
       case CipherType.Identity:
         domain.identity = IdentityExport.toDomain(req.identity);
         break;
+      case CipherType.SSHKey:
+        domain.sshKey = SSHKeyExport.toDomain(req.sshKey);
+        break;
     }
 
     if (req.passwordHistory != null) {
@@ -132,6 +139,7 @@ export class CipherExport {
   secureNote: SecureNoteExport;
   card: CardExport;
   identity: IdentityExport;
+  sshKey: SSHKeyExport;
   reprompt: CipherRepromptType;
   passwordHistory: PasswordHistoryExport[] = null;
   revisionDate: Date = null;
@@ -171,6 +179,9 @@ export class CipherExport {
       case CipherType.Identity:
         this.identity = new IdentityExport(o.identity);
         break;
+      case CipherType.SSHKey:
+        this.sshKey = new SSHKeyExport(o.sshKey);
+        break;
     }
 
     if (o.passwordHistory != null) {
diff --git a/libs/common/src/models/export/ssh-key.export.ts b/libs/common/src/models/export/ssh-key.export.ts
new file mode 100644
index 00000000000..63183d74344
--- /dev/null
+++ b/libs/common/src/models/export/ssh-key.export.ts
@@ -0,0 +1,44 @@
+import { SSHKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
+
+import { EncString } from "../../platform/models/domain/enc-string";
+import { SSHKey as SSHKeyDomain } from "../../vault/models/domain/ssh-key";
+
+import { safeGetString } from "./utils";
+
+export class SSHKeyExport {
+  static template(): SSHKeyExport {
+    const req = new SSHKeyExport();
+    req.privateKey = "";
+    req.publicKey = "";
+    req.keyFingerprint = "";
+    return req;
+  }
+
+  static toView(req: SSHKeyExport, view = new SSHKeyView()) {
+    view.privateKey = req.privateKey;
+    view.publicKey = req.publicKey;
+    view.keyFingerprint = req.keyFingerprint;
+    return view;
+  }
+
+  static toDomain(req: SSHKeyExport, domain = new SSHKeyDomain()) {
+    domain.privateKey = req.privateKey != null ? new EncString(req.privateKey) : null;
+    domain.publicKey = req.publicKey != null ? new EncString(req.publicKey) : null;
+    domain.keyFingerprint = req.keyFingerprint != null ? new EncString(req.keyFingerprint) : null;
+    return domain;
+  }
+
+  privateKey: string;
+  publicKey: string;
+  keyFingerprint: string;
+
+  constructor(o?: SSHKeyView | SSHKeyDomain) {
+    if (o == null) {
+      return;
+    }
+
+    this.privateKey = safeGetString(o.privateKey);
+    this.publicKey = safeGetString(o.publicKey);
+    this.keyFingerprint = safeGetString(o.keyFingerprint);
+  }
+}
diff --git a/libs/importer/src/components/dialog/import-success-dialog.component.ts b/libs/importer/src/components/dialog/import-success-dialog.component.ts
index 1e0d4f7fda9..01941d5512a 100644
--- a/libs/importer/src/components/dialog/import-success-dialog.component.ts
+++ b/libs/importer/src/components/dialog/import-success-dialog.component.ts
@@ -38,6 +38,7 @@ export class ImportSuccessDialogComponent implements OnInit {
     let cards = 0;
     let identities = 0;
     let secureNotes = 0;
+    let sshKeys = 0;
     this.data.ciphers.map((c) => {
       switch (c.type) {
         case CipherType.Login:
@@ -52,6 +53,9 @@ export class ImportSuccessDialogComponent implements OnInit {
         case CipherType.Identity:
           identities++;
           break;
+        case CipherType.SSHKey:
+          sshKeys++;
+          break;
         default:
           break;
       }
@@ -70,6 +74,9 @@ export class ImportSuccessDialogComponent implements OnInit {
     if (secureNotes > 0) {
       list.push({ icon: "sticky-note", type: "typeSecureNote", count: secureNotes });
     }
+    if (sshKeys > 0) {
+      list.push({ icon: "key", type: "typeSSHKey", count: sshKeys });
+    }
     if (this.data.folders.length > 0) {
       list.push({ icon: "folder", type: "folders", count: this.data.folders.length });
     }

From 65385f404e98acb851588a2256035b9633ddf515 Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Thu, 26 Sep 2024 10:22:07 -0700
Subject: [PATCH 3/8] =?UTF-8?q?[PM-10406]=20Add=20privatekey=20publickey?=
 =?UTF-8?q?=20and=20fingerprint=20to=20both=20add-edit=20and=20view=20co?=
 =?UTF-8?q?=E2=80=A6=20(#11046)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add privatekey publickey and fingerprint to both add-edit and view components

* Remove wrong a11y title

* Fix testid
---
 apps/browser/src/_locales/en/messages.json    |  9 +++
 .../item-copy-actions.component.html          |  8 +--
 .../item-copy-actions.component.ts            |  2 +-
 .../components/vault/add-edit.component.html  | 12 ++++
 .../components/vault/view.component.html      | 10 +++
 .../vault/app/vault/add-edit.component.html   | 72 ++++++++++++++++---
 .../src/vault/app/vault/add-edit.component.ts |  1 -
 .../src/vault/app/vault/view.component.html   | 54 +++++++++++++-
 .../individual-vault/add-edit.component.html  | 38 ++++++++++
 apps/web/src/locales/en/messages.json         |  3 +
 .../vault/components/add-edit.component.ts    |  5 ++
 .../src/vault/components/view.component.ts    |  5 ++
 .../src/vault/models/view/ssh-key.view.ts     | 17 ++++-
 .../sshkey-section.component.html             | 12 ++++
 .../sshkey-view.component.html                | 19 +++++
 15 files changed, 247 insertions(+), 20 deletions(-)

diff --git a/apps/browser/src/_locales/en/messages.json b/apps/browser/src/_locales/en/messages.json
index a1061e3d6e9..139d2f9c78f 100644
--- a/apps/browser/src/_locales/en/messages.json
+++ b/apps/browser/src/_locales/en/messages.json
@@ -131,6 +131,15 @@
   "copyLicenseNumber": {
     "message": "Copy license number"
   },
+  "copyPrivateKey": {
+    "message": "Copy private key"
+  },
+  "copyPublicKey": {
+    "message": "Copy public key"
+  },
+  "copyFingerprint": {
+    "message": "Copy fingerprint"
+  },
   "autoFill": {
     "message": "Autofill"
   },
diff --git a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
index ca582a71bfb..cbe3dae4333 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
@@ -89,12 +89,12 @@
     bitIconButton="bwi-clone"
     size="small"
     [appA11yTitle]="
-      hasIdentityValues ? ('copyInfoTitle' | i18n: cipher.name) : ('noValuesToCopy' | i18n)
+      hasSshKeyValues ? ('copyInfoTitle' | i18n: cipher.name) : ('noValuesToCopy' | i18n)
     "
-    [disabled]="!hasIdentityValues"
-    [bitMenuTriggerFor]="identityOptions"
+    [disabled]="!hasSshKeyValues"
+    [bitMenuTriggerFor]="sshKeyOptions"
   ></button>
-  <bit-menu #identityOptions>
+  <bit-menu #sshKeyOptions>
     <button type="button" bitMenuItem appCopyField="privateKey" [cipher]="cipher">
       {{ "copyPrivateKey" | i18n }}
     </button>
diff --git a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts
index 2df705a7294..00a775024ce 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.ts
@@ -48,7 +48,7 @@ export class ItemCopyActionsComponent {
     return !!this.cipher.notes;
   }
 
-  get hasSSHKeyValues() {
+  get hasSshKeyValues() {
     return (
       !!this.cipher.sshKey.privateKey ||
       !!this.cipher.sshKey.publicKey ||
diff --git a/apps/browser/src/vault/popup/components/vault/add-edit.component.html b/apps/browser/src/vault/popup/components/vault/add-edit.component.html
index cad3067a3ae..0567e98b912 100644
--- a/apps/browser/src/vault/popup/components/vault/add-edit.component.html
+++ b/apps/browser/src/vault/popup/components/vault/add-edit.component.html
@@ -536,6 +536,18 @@ <h2 class="box-header">
             <span class="row-label"> {{ "sshPrivateKey" | i18n }}</span>
             {{ cipher.sshKey.privateKey }}
           </div>
+          <div class="box-content-row" *ngIf="cipher.sshKey.publicKey" style="overflow: hidden">
+            <span class="row-label"> {{ "sshPublicKey" | i18n }}</span>
+            {{ cipher.sshKey.publicKey }}
+          </div>
+          <div
+            class="box-content-row"
+            *ngIf="cipher.sshKey.keyFingerprint"
+            style="overflow: hidden"
+          >
+            <span class="row-label"> {{ "sshKeyFingerprint" | i18n }}</span>
+            {{ cipher.sshKey.keyFingerprint }}
+          </div>
         </div>
       </div>
     </div>
diff --git a/apps/browser/src/vault/popup/components/vault/view.component.html b/apps/browser/src/vault/popup/components/vault/view.component.html
index 640ac0d77e6..5b158bab101 100644
--- a/apps/browser/src/vault/popup/components/vault/view.component.html
+++ b/apps/browser/src/vault/popup/components/vault/view.component.html
@@ -431,6 +431,16 @@ <h2 class="box-header">
       </div>
       <!-- SSHKey -->
       <div *ngIf="cipher.sshKey">
+        <div class="box-content-row" *ngIf="cipher.sshKey.privateKey" style="overflow: hidden">
+          <span
+            class="row-label draggable"
+            draggable="true"
+            (dragstart)="setTextDataOnDrag($event, cipher.sshKey.privateKey)"
+          >
+            {{ "sshPrivateKey" | i18n }}
+          </span>
+          <div [innerText]="cipher.sshKey.maskedPrivateKey" class="monospaced"></div>
+        </div>
         <div class="box-content-row" *ngIf="cipher.sshKey.publicKey" style="overflow: hidden">
           <span
             class="row-label draggable"
diff --git a/apps/desktop/src/vault/app/vault/add-edit.component.html b/apps/desktop/src/vault/app/vault/add-edit.component.html
index cbc5504c28e..64e15243bf0 100644
--- a/apps/desktop/src/vault/app/vault/add-edit.component.html
+++ b/apps/desktop/src/vault/app/vault/add-edit.component.html
@@ -476,11 +476,51 @@ <h2 class="box-header">
             <div class="box-content-row box-content-row-flex" appBoxRow>
               <div class="row-main">
                 <label for="sshPrivateKey">{{ "sshPrivateKey" | i18n }}</label>
+                <div
+                  *ngIf="!showPrivateKey"
+                  class="monospaced"
+                  style="white-space: pre-line"
+                  [innerText]="cipher.sshKey.maskedPrivateKey"
+                ></div>
+                <div
+                  *ngIf="showPrivateKey"
+                  class="monospaced"
+                  style="white-space: pre-line"
+                  [innerText]="cipher.sshKey.privateKey"
+                ></div>
+              </div>
+              <div class="action-buttons">
+                <button
+                  type="button"
+                  class="row-btn"
+                  appStopClick
+                  appA11yTitle="{{ 'toggleVisibility' | i18n }}"
+                  (click)="togglePrivateKey()"
+                >
+                  <i
+                    class="bwi bwi-lg"
+                    aria-hidden="true"
+                    [ngClass]="{ 'bwi-eye': !showPrivateKey, 'bwi-eye-slash': showPrivateKey }"
+                  ></i>
+                </button>
+                <button
+                  type="button"
+                  class="row-btn"
+                  appStopClick
+                  (click)="copy(this.cipher.sshKey.privateKey, 'sshPrivateKey', 'SSHPrivateKey')"
+                >
+                  <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+                </button>
+              </div>
+            </div>
+            <div class="box-content-row box-content-row-flex" appBoxRow>
+              <div class="row-main">
+                <label for="sshPublicKey">{{ "sshPublicKey" | i18n }}</label>
                 <input
                   id="sshPublicKey"
-                  type="{{ showPrivateKey ? 'text' : 'password' }}"
-                  name="SSHKey.SSHPrivateKey"
-                  [ngModel]="cipher.sshKey.privateKey"
+                  type="text"
+                  name="SSHKey.SSHPublicKey"
+                  [ngModel]="cipher.sshKey.publicKey"
                   readonly
                 />
               </div>
@@ -489,22 +529,32 @@ <h2 class="box-header">
                   type="button"
                   class="row-btn"
                   appStopClick
-                  (click)="copy(this.cipher.sshKey.privateKey, 'sshPrivateKey', 'SSHPrivateKey')"
+                  (click)="copy(cipher.sshKey.publicKey, 'sshPublicKey', 'SSHPublicKey')"
                 >
                   <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
                 </button>
+              </div>
+            </div>
+            <div class="box-content-row box-content-row-flex" appBoxRow>
+              <div class="row-main">
+                <label for="sshKeyFingerprint">{{ "sshFingerprint" | i18n }}</label>
+                <input
+                  id="sshKeyFingerprint"
+                  type="text"
+                  name="SSHKey.SSHKeyFingerprint"
+                  [ngModel]="cipher.sshKey.keyFingerprint"
+                  readonly
+                />
+              </div>
+              <div class="action-buttons">
                 <button
                   type="button"
                   class="row-btn"
                   appStopClick
-                  appA11yTitle="{{ 'toggleVisibility' | i18n }}"
-                  (click)="togglePrivateKey()"
+                  (click)="copy(cipher.sshKey.keyFingerprint, 'sshFingerprint', 'SSHFingerprint')"
+                  appA11yTitle="{{ 'generateSSHKey' | i18n }}"
                 >
-                  <i
-                    class="bwi bwi-lg"
-                    aria-hidden="true"
-                    [ngClass]="{ 'bwi-eye': !showPrivateKey, 'bwi-eye-slash': showPrivateKey }"
-                  ></i>
+                  <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
                 </button>
               </div>
             </div>
diff --git a/apps/desktop/src/vault/app/vault/add-edit.component.ts b/apps/desktop/src/vault/app/vault/add-edit.component.ts
index 060471d5a5f..87355ab930d 100644
--- a/apps/desktop/src/vault/app/vault/add-edit.component.ts
+++ b/apps/desktop/src/vault/app/vault/add-edit.component.ts
@@ -30,7 +30,6 @@ const BroadcasterSubscriptionId = "AddEditComponent";
 export class AddEditComponent extends BaseAddEditComponent implements OnInit, OnChanges, OnDestroy {
   @ViewChild("form")
   private form: NgForm;
-  showPrivateKey = false;
 
   constructor(
     cipherService: CipherService,
diff --git a/apps/desktop/src/vault/app/vault/view.component.html b/apps/desktop/src/vault/app/vault/view.component.html
index 4e897c2b53d..0512d0af544 100644
--- a/apps/desktop/src/vault/app/vault/view.component.html
+++ b/apps/desktop/src/vault/app/vault/view.component.html
@@ -401,7 +401,53 @@ <h2 class="box-header">
         </div>
         <!-- SSH Key -->
         <div *ngIf="cipher.sshKey">
-          <div class="box-content-row box-content-row-flex" appBoxRow>
+          <div class="box-content-row box-content-row-flex" *ngIf="cipher.sshKey.privateKey">
+            <div class="row-main">
+              <span class="row-label">{{ "sshPrivateKey" | i18n }}</span>
+              <div
+                *ngIf="!showPrivateKey"
+                class="monospaced"
+                style="white-space: pre-line"
+                [innerText]="cipher.sshKey.maskedPrivateKey"
+              ></div>
+              <div
+                *ngIf="showPrivateKey"
+                class="monospaced"
+                style="white-space: pre-line"
+                [innerText]="cipher.sshKey.privateKey"
+              ></div>
+            </div>
+            <div class="action-buttons" *ngIf="cipher.viewPassword">
+              <button
+                type="button"
+                class="row-btn"
+                appStopClick
+                appA11yTitle="{{ 'toggleVisibility' | i18n }}"
+                [attr.aria-pressed]="showPrivateKey"
+                (click)="togglePrivateKey()"
+              >
+                <i
+                  class="bwi bwi-lg"
+                  aria-hidden="true"
+                  [ngClass]="{ 'bwi-eye': !showPrivateKey, 'bwi-eye-slash': showPrivateKey }"
+                ></i>
+              </button>
+              <button
+                type="button"
+                class="row-btn"
+                appStopClick
+                appA11yTitle="{{ 'copySSHPrivateKey' | i18n }}"
+                (click)="copy(cipher.sshKey.privateKey, 'sshPrivateKey', 'SshPrivateKey')"
+              >
+                <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+              </button>
+            </div>
+          </div>
+          <div
+            class="box-content-row box-content-row-flex"
+            *ngIf="cipher.sshKey.publicKey"
+            appBoxRow
+          >
             <div class="row-main">
               <label for="sshPublicKey">{{ "sshPublicKey" | i18n }}</label>
               <input
@@ -424,7 +470,11 @@ <h2 class="box-header">
               </button>
             </div>
           </div>
-          <div class="box-content-row box-content-row-flex" appBoxRow>
+          <div
+            class="box-content-row box-content-row-flex"
+            *ngIf="cipher.sshKey.keyFingerprint"
+            appBoxRow
+          >
             <div class="row-main">
               <label for="sshKeyFingerprint">{{ "sshFingerprint" | i18n }}</label>
               <input
diff --git a/apps/web/src/app/vault/individual-vault/add-edit.component.html b/apps/web/src/app/vault/individual-vault/add-edit.component.html
index 82338caa1a6..d5f47cabfb1 100644
--- a/apps/web/src/app/vault/individual-vault/add-edit.component.html
+++ b/apps/web/src/app/vault/individual-vault/add-edit.component.html
@@ -850,6 +850,44 @@ <h1 class="modal-title" id="cipherAddEditTitle">{{ title }}</h1>
         <!-- SSH Key -->
         <ng-container *ngIf="cipher.type === cipherType.SSHKey">
           <div class="row">
+            <div class="col-12 form-group">
+              <label for="sshKeyPrivateKey">{{ "sshKeyPrivateKey" | i18n }}</label>
+              <div class="input-group">
+                <input
+                  id="sshKeyPrivateKey"
+                  class="form-control"
+                  type="{{ showPrivateKey ? 'text' : 'password' }}"
+                  name="SSHKey.PrivateKey"
+                  [(ngModel)]="cipher.sshKey.privateKey"
+                  appInputVerbatim
+                  disabled
+                  readonly
+                />
+                <div class="input-group-append" *ngIf="!cipher.isDeleted">
+                  <button
+                    type="button"
+                    class="btn btn-outline-secondary"
+                    appA11yTitle="{{ 'toggleVisibility' | i18n }}"
+                    (click)="togglePrivateKey()"
+                    [disabled]="!cipher.viewPassword"
+                  >
+                    <i
+                      class="bwi bwi-lg"
+                      aria-hidden="true"
+                      [ngClass]="{ 'bwi-eye': !showPrivateKey, 'bwi-eye-slash': showPrivateKey }"
+                    ></i>
+                  </button>
+                  <button
+                    type="button"
+                    class="btn btn-outline-secondary"
+                    appA11yTitle="{{ 'copySSHPrivateKey' | i18n }}"
+                    (click)="copy(cipher.sshKey.privateKey, 'sshKeyPrivateKey', 'PrivateKey')"
+                  >
+                    <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+                  </button>
+                </div>
+              </div>
+            </div>
             <div class="col-12 form-group">
               <label for="sshKeyPublicKey">{{ "sshKeyPublicKey" | i18n }}</label>
               <div class="input-group">
diff --git a/apps/web/src/locales/en/messages.json b/apps/web/src/locales/en/messages.json
index 853211e0e0d..df55b27ccf7 100644
--- a/apps/web/src/locales/en/messages.json
+++ b/apps/web/src/locales/en/messages.json
@@ -8958,6 +8958,9 @@
   "sshKeyFingerprint": {
     "message": "Fingerprint"
   },
+  "sshKeyPrivateKey": {
+    "message": "Private key"
+  },
   "sshKeyPublicKey": {
     "message": "Public key"
   },
diff --git a/libs/angular/src/vault/components/add-edit.component.ts b/libs/angular/src/vault/components/add-edit.component.ts
index 59d179d48e7..f5490f2d5df 100644
--- a/libs/angular/src/vault/components/add-edit.component.ts
+++ b/libs/angular/src/vault/components/add-edit.component.ts
@@ -69,6 +69,7 @@ export class AddEditComponent implements OnInit, OnDestroy {
   restorePromise: Promise<any>;
   checkPasswordPromise: Promise<number>;
   showPassword = false;
+  showPrivateKey = false;
   showTotpSeed = false;
   showCardNumber = false;
   showCardCode = false;
@@ -599,6 +600,10 @@ export class AddEditComponent implements OnInit, OnDestroy {
     }
   }
 
+  togglePrivateKey() {
+    this.showPrivateKey = !this.showPrivateKey;
+  }
+
   toggleUriOptions(uri: LoginUriView) {
     const u = uri as any;
     u.showOptions = u.showOptions == null && uri.match != null ? false : !u.showOptions;
diff --git a/libs/angular/src/vault/components/view.component.ts b/libs/angular/src/vault/components/view.component.ts
index a6e96bc542a..a04b89f9865 100644
--- a/libs/angular/src/vault/components/view.component.ts
+++ b/libs/angular/src/vault/components/view.component.ts
@@ -55,6 +55,7 @@ export class ViewComponent implements OnDestroy, OnInit {
   showPasswordCount: boolean;
   showCardNumber: boolean;
   showCardCode: boolean;
+  showPrivateKey: boolean;
   canAccessPremium: boolean;
   showPremiumRequiredTotp: boolean;
   totpCode: string;
@@ -315,6 +316,10 @@ export class ViewComponent implements OnDestroy, OnInit {
     }
   }
 
+  togglePrivateKey() {
+    this.showPrivateKey = !this.showPrivateKey;
+  }
+
   async checkPassword() {
     if (
       this.cipher.login == null ||
diff --git a/libs/common/src/vault/models/view/ssh-key.view.ts b/libs/common/src/vault/models/view/ssh-key.view.ts
index f3547254a51..7a40972573a 100644
--- a/libs/common/src/vault/models/view/ssh-key.view.ts
+++ b/libs/common/src/vault/models/view/ssh-key.view.ts
@@ -16,8 +16,23 @@ export class SSHKeyView extends ItemView {
     }
   }
 
+  get maskedPrivateKey(): string {
+    let lines = this.privateKey.split("\n").filter((l) => l.trim() !== "");
+    lines = lines.map((l, i) => {
+      if (i === 0 || i === lines.length - 1) {
+        return l;
+      }
+      return this.maskLine(l);
+    });
+    return lines.join("\n");
+  }
+
+  private maskLine(line: string): string {
+    return "•".repeat(32);
+  }
+
   get subTitle(): string {
-    return null;
+    return this.keyFingerprint;
   }
 
   static fromJSON(obj: Partial<Jsonify<SSHKeyView>>): SSHKeyView {
diff --git a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
index 4c85ce782e2..2e9207f8465 100644
--- a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
+++ b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
@@ -5,6 +5,18 @@ <h2 bitTypography="h6">
     </h2>
   </bit-section-header>
   <bit-card>
+    <bit-form-field>
+      <bit-label>{{ "sshPrivateKey" | i18n }}</bit-label>
+      <input id="privateKey" bitInput formControlName="privateKey" type="password" />
+      <button
+        type="button"
+        bitIconButton
+        bitSuffix
+        data-testid="toggle-privateKey-visibility"
+        bitPasswordInputToggle
+      ></button>
+    </bit-form-field>
+
     <bit-form-field>
       <bit-label>{{ "sshPublicKey" | i18n }}</bit-label>
       <input id="publicKey" bitInput formControlName="publicKey" />
diff --git a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
index 4f8159c2915..7f403193d44 100644
--- a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
+++ b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
@@ -3,6 +3,25 @@
     <h2 bitTypography="h6">{{ "typeSSHKey" | i18n }}</h2>
   </bit-section-header>
   <bit-card class="[&_bit-form-field:last-of-type]:tw-mb-0">
+    <bit-form-field>
+      <bit-label>{{ "sshPrivateKey" | i18n }}</bit-label>
+      <input readonly bitInput [value]="sshKey.privateKey" aria-readonly="true" type="password" />
+      <button
+        bitSuffix
+        type="button"
+        bitIconButton
+        bitPasswordInputToggle
+        data-testid="toggle-privateKey"
+      ></button>
+      <button
+        bitIconButton="bwi-clone"
+        bitSuffix
+        type="button"
+        [appCopyClick]="sshKey.privateKey"
+        showToast
+        [appA11yTitle]="'copyValue' | i18n"
+      ></button>
+    </bit-form-field>
     <bit-form-field>
       <bit-label>{{ "sshPublicKey" | i18n }}</bit-label>
       <input readonly bitInput [value]="sshKey.publicKey" aria-readonly="true" />

From 61faf540e12abfaae8b35d0ab55e73ae00389dab Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Thu, 26 Sep 2024 11:05:06 -0700
Subject: [PATCH 4/8] [PM-10098] SSH Agent & SSH Key creation for Bitwarden
 Desktop (#10293)

* Add ssh agent, generator & import

* Move ssh agent code to bitwarden-russh crate

* Remove generator component

* Cleanup

* Cleanup

* Remove left over sshGenerator reference

* Cleanup

* Add documentation to sshkeyimportstatus

* Fix outdated variable name

* Update apps/desktop/src/platform/preload.ts

Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>

* Rename renderersshagent

* Rename MainSshAgentService

* Improve clarity of 'id' variables being used

* Improve clarity of 'id' variables being used

* Update apps/desktop/src/vault/app/vault/add-edit.component.html

Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>

* Fix outdated cipher/messageid names

* Rename SSH to Ssh

* Make agent syncing more reactive

* Move constants to top of class

* Make sshkey cipher filtering clearer

* Add stricter equality check on ssh key unlock

* Fix build and messages

* Fix incorrect featureflag name

* Replace anonymous async function with switchmap pipe

* Fix build

* Update apps/desktop/desktop_native/napi/src/lib.rs

Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>

* Revert incorrectly renamed 'Ssh' usages to SSH

* Run cargo fmt

* Clean up ssh agent sock path logic

* Cleanup and split to platform specific files

* Small cleanup

* Pull out generator and importer into core

* Rename renderersshagentservice to sshagentservice

* Rename cipheruuid to cipher_id

* Drop ssh dependencies from napi crate

* Clean up windows build

* Small cleanup

* Small cleanup

* Cleanup

* Add rxjs pipeline for agent services

* [PM-12555] Pkcs8 sshkey import & general ssh key import tests (#11048)

* Add pkcs8 import and tests

* Add key type unsupported error

* Remove unsupported formats

* Remove code for unsupported formats

* Fix encrypted pkcs8 import

* Add ed25519 pkcs8 unencrypted test file

* SSH agent rxjs tweaks (#11148)

* feat: rewrite sshagent.signrequest as purely observable

* feat: fail the request when unlock times out

* chore: clean up, add some clarifying comments

* chore: remove unused dependency

* fix: result `undefined` crashing in NAPI -> Rust

* Allow concurrent SSH requests in rust

* Remove unwraps

* Cleanup and add init service init call

* Fix windows

* Fix timeout behavior on locked vault

---------

Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>
---
 .github/CODEOWNERS                            |   7 +-
 apps/browser/src/_locales/en/messages.json    |   8 +-
 .../add-edit/add-edit-v2.component.ts         |   4 +-
 .../item-copy-actions.component.html          |   2 +-
 .../vault-v2/view-v2/view-v2.component.ts     |   4 +-
 .../components/vault/add-edit.component.html  |   2 +-
 .../vault/vault-filter.component.html         |   6 +-
 .../components/vault/vault-items.component.ts |   2 +-
 .../components/vault/view.component.html      |   2 +-
 .../vault-popup-items.service.spec.ts         |   2 +-
 .../services/vault-popup-items.service.ts     |   2 +-
 .../vault-popup-list-filters.service.spec.ts  |   2 +-
 .../vault-popup-list-filters.service.ts       |   4 +-
 apps/desktop/desktop_native/Cargo.lock        | 709 +++++++++++++++++-
 apps/desktop/desktop_native/core/Cargo.toml   |  44 +-
 .../desktop_native/core/src/biometric/mod.rs  |   5 +-
 .../desktop_native/core/src/biometric/unix.rs |  22 +-
 .../core/src/biometric/windows.rs             |   1 -
 apps/desktop/desktop_native/core/src/lib.rs   |   3 +-
 .../desktop_native/core/src/password/unix.rs  |   6 +-
 .../core/src/powermonitor/linux.rs            |  12 +-
 .../core/src/process_isolation/linux.rs       |  14 +-
 .../core/src/ssh_agent/generator.rs           |  45 ++
 .../core/src/ssh_agent/importer.rs            | 395 ++++++++++
 .../desktop_native/core/src/ssh_agent/mod.rs  | 118 +++
 .../ssh_agent/named_pipe_listener_stream.rs   |  60 ++
 .../test_keys/ecdsa_openssh_unencrypted       |   8 +
 .../test_keys/ecdsa_openssh_unencrypted.pub   |   1 +
 .../test_keys/ed25519_openssh_encrypted       |   8 +
 .../test_keys/ed25519_openssh_encrypted.pub   |   1 +
 .../test_keys/ed25519_openssh_unencrypted     |   7 +
 .../test_keys/ed25519_openssh_unencrypted.pub |   1 +
 .../test_keys/ed25519_pkcs8_unencrypted       |   4 +
 .../test_keys/ed25519_pkcs8_unencrypted.pub   |   1 +
 .../ssh_agent/test_keys/rsa_openssh_encrypted |  39 +
 .../test_keys/rsa_openssh_encrypted.pub       |   1 +
 .../test_keys/rsa_openssh_unencrypted         |  38 +
 .../test_keys/rsa_openssh_unencrypted.pub     |   1 +
 .../ssh_agent/test_keys/rsa_pkcs8_encrypted   |  42 ++
 .../test_keys/rsa_pkcs8_encrypted.pub         |   1 +
 .../ssh_agent/test_keys/rsa_pkcs8_unencrypted |  40 +
 .../test_keys/rsa_pkcs8_unencrypted.pub       |   1 +
 .../desktop_native/core/src/ssh_agent/unix.rs |  77 ++
 .../core/src/ssh_agent/windows.rs             |  41 +
 apps/desktop/desktop_native/napi/Cargo.toml   |   4 +
 apps/desktop/desktop_native/napi/index.d.ts   |  36 +-
 apps/desktop/desktop_native/napi/index.js     |   3 +-
 apps/desktop/desktop_native/napi/src/lib.rs   | 213 +++++-
 .../src/app/accounts/settings.component.html  |  17 +
 .../src/app/accounts/settings.component.ts    |   7 +
 apps/desktop/src/app/app.module.ts            |   2 +
 apps/desktop/src/app/services/init.service.ts |   3 +
 apps/desktop/src/locales/en/messages.json     |  66 +-
 apps/desktop/src/main.ts                      |   4 +
 apps/desktop/src/main/window.main.ts          |  13 +
 .../components/approve-ssh-request.html       |  17 +
 .../components/approve-ssh-request.ts         |  59 ++
 .../platform/main/main-ssh-agent.service.ts   | 115 +++
 apps/desktop/src/platform/preload.ts          |  25 +
 .../services/desktop-settings.service.ts      |  15 +
 .../platform/services/ssh-agent.service.ts    | 175 +++++
 .../vault/app/vault/add-edit.component.html   |  31 +-
 .../src/vault/app/vault/add-edit.component.ts |  61 +-
 .../filters/type-filter.component.html        |   8 +-
 .../src/vault/app/vault/view.component.html   |  14 +-
 .../individual-vault/add-edit.component.html  |  12 +-
 .../components/vault-filter.component.ts      |   4 +-
 apps/web/src/locales/en/messages.json         |   4 +-
 .../vault/components/add-edit.component.ts    |  11 +-
 libs/common/src/enums/feature-flag.enum.ts    |   3 +
 .../common/src/models/export/cipher.export.ts |  16 +-
 .../src/models/export/ssh-key.export.ts       |  16 +-
 libs/common/src/vault/enums/cipher-type.ts    |   2 +-
 .../src/vault/icon/build-cipher-icon.ts       |   2 +-
 .../src/vault/models/api/ssh-key.api.ts       |   2 +-
 .../src/vault/models/data/cipher.data.ts      |   8 +-
 .../src/vault/models/data/ssh-key.data.ts     |   6 +-
 libs/common/src/vault/models/domain/cipher.ts |  18 +-
 .../src/vault/models/domain/ssh-key.spec.ts   |  30 +-
 .../common/src/vault/models/domain/ssh-key.ts |  20 +-
 .../vault/models/request/cipher.request.ts    |   8 +-
 .../vault/models/response/cipher.response.ts  |   6 +-
 .../src/vault/models/view/cipher.view.ts      |  10 +-
 .../src/vault/models/view/ssh-key.view.ts     |  10 +-
 .../src/vault/services/cipher.service.ts      |   6 +-
 .../dialog/import-success-dialog.component.ts |   2 +-
 .../src/cipher-form/cipher-form-container.ts  |   4 +-
 .../components/cipher-form.component.html     |   2 +-
 .../components/cipher-form.component.ts       |   4 +-
 .../sshkey-section.component.html             |   2 +-
 .../sshkey-section.component.ts               |   2 +-
 .../cipher-view/cipher-view.component.html    |   2 +-
 .../src/cipher-view/cipher-view.component.ts  |   4 +-
 .../sshkey-view.component.html                |   2 +-
 .../sshkey-sections/sshkey-view.component.ts  |   6 +-
 95 files changed, 2678 insertions(+), 227 deletions(-)
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/generator.rs
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/importer.rs
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/mod.rs
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/named_pipe_listener_stream.rs
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted.pub
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/unix.rs
 create mode 100644 apps/desktop/desktop_native/core/src/ssh_agent/windows.rs
 create mode 100644 apps/desktop/src/platform/components/approve-ssh-request.html
 create mode 100644 apps/desktop/src/platform/components/approve-ssh-request.ts
 create mode 100644 apps/desktop/src/platform/main/main-ssh-agent.service.ts
 create mode 100644 apps/desktop/src/platform/services/ssh-agent.service.ts

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 9eace676f4f..b892d9f78eb 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -100,8 +100,8 @@ apps/desktop/src/services/native-message-handler.service.ts @bitwarden/team-auto
 ## Component Library ##
 .storybook @bitwarden/team-design-system
 libs/components @bitwarden/team-design-system
-apps/browser/src/platform/popup/layout @bitwarden/team-design-system 
-apps/web/src/app/layouts @bitwarden/team-design-system 
+apps/browser/src/platform/popup/layout @bitwarden/team-design-system
+apps/web/src/app/layouts @bitwarden/team-design-system
 
 ## Desktop native module ##
 apps/desktop/desktop_native @bitwarden/team-platform-dev
@@ -121,3 +121,6 @@ apps/browser/store/locales/en
 apps/cli/src/locales/en/messages.json
 apps/desktop/src/locales/en/messages.json
 apps/web/src/locales/en/messages.json
+
+## Ssh agent temporary co-codeowner
+apps/desktop/desktop_native/core/src/ssh_agent @bitwarden/team-platform-dev @bitwarden/wg-ssh-keys
diff --git a/apps/browser/src/_locales/en/messages.json b/apps/browser/src/_locales/en/messages.json
index 139d2f9c78f..d142a7bacff 100644
--- a/apps/browser/src/_locales/en/messages.json
+++ b/apps/browser/src/_locales/en/messages.json
@@ -328,7 +328,7 @@
   "createFoldersToOrganize": {
     "message": "Create folders to organize your vault items"
   },
-  "deleteFolderPermanently":{
+  "deleteFolderPermanently": {
     "message": "Are you sure you want to permanently delete this folder?"
   },
   "deleteFolder": {
@@ -1602,7 +1602,7 @@
   "typeIdentity": {
     "message": "Identity"
   },
-  "typeSSHKey": {
+  "typeSshKey": {
     "message": "SSH key"
   },
   "newItemHeader": {
@@ -1852,7 +1852,7 @@
     "message": "Use this password"
   },
   "useThisUsername": {
-      "message": "Use this username"
+    "message": "Use this username"
   },
   "securePasswordGenerated": {
     "message": "Secure password generated! Don't forget to also update your password on the website."
@@ -3189,7 +3189,7 @@
     "message": "Unlock your account, opens in a new window",
     "description": "Screen reader text (aria-label) for unlock account button in overlay"
   },
-  "fillCredentialsFor":  {
+  "fillCredentialsFor": {
     "message": "Fill credentials for",
     "description": "Screen reader text for when overlay item is in focused"
   },
diff --git a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
index 006c5875ae2..7d7f877e1dd 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/add-edit/add-edit-v2.component.ts
@@ -300,8 +300,8 @@ export class AddEditV2Component implements OnInit {
         return this.i18nService.t(partOne, this.i18nService.t("typeIdentity"));
       case CipherType.SecureNote:
         return this.i18nService.t(partOne, this.i18nService.t("note"));
-      case CipherType.SSHKey:
-        return this.i18nService.t(partOne, this.i18nService.t("typeSSHKey"));
+      case CipherType.SshKey:
+        return this.i18nService.t(partOne, this.i18nService.t("typeSshKey"));
     }
   }
 }
diff --git a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
index cbe3dae4333..6c7dcec15f9 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
+++ b/apps/browser/src/vault/popup/components/vault-v2/item-copy-action/item-copy-actions.component.html
@@ -83,7 +83,7 @@
   ></button>
 </bit-item-action>
 
-<bit-item-action *ngIf="cipher.type === CipherType.SSHKey">
+<bit-item-action *ngIf="cipher.type === CipherType.SshKey">
   <button
     type="button"
     bitIconButton="bwi-clone"
diff --git a/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts b/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
index 1617c8fc9a9..f8909256591 100644
--- a/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
@@ -100,8 +100,8 @@ export class ViewV2Component {
         );
       case CipherType.SecureNote:
         return this.i18nService.t("viewItemHeader", this.i18nService.t("note").toLowerCase());
-      case CipherType.SSHKey:
-        return this.i18nService.t("viewItemHeader", this.i18nService.t("typeSSHkey").toLowerCase());
+      case CipherType.SshKey:
+        return this.i18nService.t("viewItemHeader", this.i18nService.t("typeSshkey").toLowerCase());
     }
   }
 
diff --git a/apps/browser/src/vault/popup/components/vault/add-edit.component.html b/apps/browser/src/vault/popup/components/vault/add-edit.component.html
index 0567e98b912..bbe1e89cd9c 100644
--- a/apps/browser/src/vault/popup/components/vault/add-edit.component.html
+++ b/apps/browser/src/vault/popup/components/vault/add-edit.component.html
@@ -530,7 +530,7 @@ <h2 class="box-header">
           </div>
         </div>
 
-        <!-- SSHKey -->
+        <!-- SshKey -->
         <div *ngIf="cipher.sshKey">
           <div class="box-content-row" *ngIf="cipher.sshKey.privateKey" style="overflow: hidden">
             <span class="row-label"> {{ "sshPrivateKey" | i18n }}</span>
diff --git a/apps/browser/src/vault/popup/components/vault/vault-filter.component.html b/apps/browser/src/vault/popup/components/vault/vault-filter.component.html
index 7f0ef0f569c..f5c28b2bebd 100644
--- a/apps/browser/src/vault/popup/components/vault/vault-filter.component.html
+++ b/apps/browser/src/vault/popup/components/vault/vault-filter.component.html
@@ -118,13 +118,13 @@ <h2 class="box-header">
           type="button"
           class="box-content-row"
           appStopClick
-          (click)="selectType(cipherType.SSHKey)"
+          (click)="selectType(cipherType.SshKey)"
         >
           <div class="row-main">
             <div class="icon"><i class="bwi bwi-fw bwi-lg bwi-key"></i></div>
-            <span class="text">{{ "typeSSHKey" | i18n }}</span>
+            <span class="text">{{ "typeSshKey" | i18n }}</span>
           </div>
-          <span class="row-sub-label">{{ typeCounts.get(cipherType.SSHKey) || 0 }}</span>
+          <span class="row-sub-label">{{ typeCounts.get(cipherType.SshKey) || 0 }}</span>
           <span><i class="bwi bwi-angle-right bwi-lg row-sub-icon"></i></span>
         </button>
       </div>
diff --git a/apps/browser/src/vault/popup/components/vault/vault-items.component.ts b/apps/browser/src/vault/popup/components/vault/vault-items.component.ts
index e360fb5971c..ce05a6a8a60 100644
--- a/apps/browser/src/vault/popup/components/vault/vault-items.component.ts
+++ b/apps/browser/src/vault/popup/components/vault/vault-items.component.ts
@@ -107,7 +107,7 @@ export class VaultItemsComponent extends BaseVaultItemsComponent implements OnIn
           case CipherType.SecureNote:
             this.groupingTitle = this.i18nService.t("secureNotes");
             break;
-          case CipherType.SSHKey:
+          case CipherType.SshKey:
             this.groupingTitle = this.i18nService.t("sshKeys");
             break;
           default:
diff --git a/apps/browser/src/vault/popup/components/vault/view.component.html b/apps/browser/src/vault/popup/components/vault/view.component.html
index 5b158bab101..408bed85558 100644
--- a/apps/browser/src/vault/popup/components/vault/view.component.html
+++ b/apps/browser/src/vault/popup/components/vault/view.component.html
@@ -429,7 +429,7 @@ <h2 class="box-header">
           <div *ngIf="cipher.identity.country">{{ cipher.identity.country }}</div>
         </div>
       </div>
-      <!-- SSHKey -->
+      <!-- SshKey -->
       <div *ngIf="cipher.sshKey">
         <div class="box-content-row" *ngIf="cipher.sshKey.privateKey" style="overflow: hidden">
           <span
diff --git a/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts b/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
index 322f34aaa49..2eef93d1721 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-items.service.spec.ts
@@ -201,7 +201,7 @@ describe("VaultPopupItemsService", () => {
         [CipherType.Card]: 2,
         [CipherType.Identity]: 3,
         [CipherType.SecureNote]: 4,
-        [CipherType.SSHKey]: 5,
+        [CipherType.SshKey]: 5,
       };
 
       // Assume all ciphers are autofill ciphers to test sorting
diff --git a/apps/browser/src/vault/popup/services/vault-popup-items.service.ts b/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
index 529de4d488c..15c7f71f3fe 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-items.service.ts
@@ -257,7 +257,7 @@ export class VaultPopupItemsService {
       [CipherType.Card]: 2,
       [CipherType.Identity]: 3,
       [CipherType.SecureNote]: 4,
-      [CipherType.SSHKey]: 5,
+      [CipherType.SshKey]: 5,
     };
 
     // Compare types first
diff --git a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
index e416486728a..0ec99a3d03f 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.spec.ts
@@ -99,7 +99,7 @@ describe("VaultPopupListFiltersService", () => {
         CipherType.Card,
         CipherType.Identity,
         CipherType.SecureNote,
-        CipherType.SSHKey,
+        CipherType.SshKey,
       ]);
     });
   });
diff --git a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
index 7cd5c6a0af3..8290179eab9 100644
--- a/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
+++ b/apps/browser/src/vault/popup/services/vault-popup-list-filters.service.ts
@@ -166,8 +166,8 @@ export class VaultPopupListFiltersService {
       icon: "bwi-sticky-note",
     },
     {
-      value: CipherType.SSHKey,
-      label: this.i18nService.t("typeSSHKey"),
+      value: CipherType.SshKey,
+      label: this.i18nService.t("typeSshKey"),
       icon: "bwi-key",
     },
   ];
diff --git a/apps/desktop/desktop_native/Cargo.lock b/apps/desktop/desktop_native/Cargo.lock
index 0cc31277cee..5757044d081 100644
--- a/apps/desktop/desktop_native/Cargo.lock
+++ b/apps/desktop/desktop_native/Cargo.lock
@@ -17,6 +17,16 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -28,6 +38,20 @@ dependencies = [
  "cpufeatures",
 ]
 
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -186,6 +210,28 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "async-stream"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd56dd203fef61ac097dd65721a419ddccb106b2d2b70ba60a6b529f03961a51"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "async-task"
 version = "4.7.1"
@@ -236,12 +282,51 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
+[[package]]
+name = "bcrypt-pbkdf"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aeac2e1fe888769f34f05ac343bbef98b14d1ffb292ab69d4608b3abc86f2a2"
+dependencies = [
+ "blowfish",
+ "pbkdf2",
+ "sha2",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
 [[package]]
 name = "bitflags"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
+[[package]]
+name = "bitwarden-russh"
+version = "0.1.0"
+source = "git+https://github.com/bitwarden/bitwarden-russh.git?branch=km/pm-10098/clean-russh-implementation#86ff1bf2f4620a3ae5684adee31abdbee33c6f07"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "futures",
+ "russh-cryptovec",
+ "ssh-encoding",
+ "ssh-key",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -282,6 +367,22 @@ dependencies = [
  "piper",
 ]
 
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes"
 version = "1.7.1"
@@ -331,6 +432,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
 [[package]]
 name = "cipher"
 version = "0.4.4"
@@ -369,6 +481,12 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "convert_case"
 version = "0.6.0"
@@ -429,6 +547,41 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "cxx"
 version = "1.0.124"
@@ -473,6 +626,17 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "der"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "derive-new"
 version = "0.6.0"
@@ -491,21 +655,36 @@ dependencies = [
  "aes",
  "anyhow",
  "arboard",
+ "async-stream",
  "base64",
+ "bitwarden-russh",
+ "byteorder",
  "cbc",
  "core-foundation",
+ "ed25519",
+ "futures",
  "gio",
+ "homedir",
  "keytar",
  "libc",
  "libsecret",
+ "pin-project",
+ "pkcs8",
  "rand",
+ "rand_chacha",
  "retry",
+ "rsa",
+ "russh-cryptovec",
  "scopeguard",
  "security-framework",
  "security-framework-sys",
  "sha2",
+ "ssh-encoding",
+ "ssh-key",
  "thiserror",
  "tokio",
+ "tokio-stream",
+ "tokio-util",
  "typenum",
  "widestring",
  "windows",
@@ -518,10 +697,14 @@ name = "desktop_napi"
 version = "0.0.0"
 dependencies = [
  "anyhow",
+ "base64",
  "desktop_core",
+ "hex",
  "napi",
  "napi-build",
  "napi-derive",
+ "tokio",
+ "tokio-stream",
 ]
 
 [[package]]
@@ -531,7 +714,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
+ "const-oid",
  "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -549,6 +734,28 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "sha2",
+ "subtle",
+]
+
 [[package]]
 name = "endi"
 version = "1.1.0"
@@ -625,6 +832,12 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "fixedbitset"
 version = "0.4.2"
@@ -637,6 +850,21 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "futures"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.30"
@@ -644,6 +872,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
@@ -711,6 +940,7 @@ version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
+ "futures-channel",
  "futures-core",
  "futures-io",
  "futures-macro",
@@ -753,6 +983,16 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
 [[package]]
 name = "gimli"
 version = "0.29.0"
@@ -796,7 +1036,7 @@ version = "0.19.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b664491bc77ab55daa6714a592cdbe1a55e28abec09cb50e87689b90de456ff4"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "futures-channel",
  "futures-core",
  "futures-executor",
@@ -876,6 +1116,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "home"
 version = "0.5.9"
@@ -885,6 +1134,18 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "homedir"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bed305c13ce3829a09d627f5d43ff738482a09361ae4eb8039993b55fb10e5e"
+dependencies = [
+ "cfg-if",
+ "nix 0.26.4",
+ "widestring",
+ "windows",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.2.6"
@@ -926,6 +1187,15 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.155"
@@ -939,9 +1209,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c2a198fb6b0eada2a8df47933734e6d35d350665a33a3593d7164fa52c75c19"
 dependencies = [
  "cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
+[[package]]
+name = "libm"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
+
 [[package]]
 name = "libsecret"
 version = "0.5.0"
@@ -1005,6 +1281,15 @@ version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -1029,13 +1314,25 @@ dependencies = [
  "adler",
 ]
 
+[[package]]
+name = "mio"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4569e456d394deccd22ce1c1913e6ea0e54519f577285001215d33557431afe4"
+dependencies = [
+ "hermit-abi 0.3.9",
+ "libc",
+ "wasi",
+ "windows-sys",
+]
+
 [[package]]
 name = "napi"
 version = "2.16.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfc300228808a0e6aea5a58115c82889240bcf8dab16fc25ad675b33e454b368"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "ctor",
  "napi-derive",
  "napi-sys",
@@ -1087,13 +1384,26 @@ dependencies = [
  "libloading",
 ]
 
+[[package]]
+name = "nix"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
+]
+
 [[package]]
 name = "nix"
 version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "cfg-if",
  "cfg_aliases 0.1.1",
  "libc",
@@ -1105,11 +1415,11 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "cfg-if",
  "cfg_aliases 0.2.1",
  "libc",
- "memoffset",
+ "memoffset 0.9.1",
 ]
 
 [[package]]
@@ -1123,13 +1433,50 @@ dependencies = [
 ]
 
 [[package]]
-name = "num_cpus"
-version = "1.16.0"
+name = "num-bigint-dig"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
 dependencies = [
- "hermit-abi 0.3.9",
- "libc",
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
 ]
 
 [[package]]
@@ -1154,7 +1501,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "block2",
  "libc",
  "objc2",
@@ -1170,7 +1517,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "block2",
  "objc2",
  "objc2-foundation",
@@ -1200,7 +1547,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "block2",
  "libc",
  "objc2",
@@ -1212,7 +1559,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "block2",
  "objc2",
  "objc2-foundation",
@@ -1224,7 +1571,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "block2",
  "objc2",
  "objc2-foundation",
@@ -1246,6 +1593,12 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "ordered-stream"
 version = "0.2.0"
@@ -1295,6 +1648,25 @@ dependencies = [
  "windows-targets 0.52.5",
 ]
 
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest",
+ "hmac",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "petgraph"
 version = "0.6.5"
@@ -1305,6 +1677,26 @@ dependencies = [
  "indexmap",
 ]
 
+[[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.14"
@@ -1328,6 +1720,44 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs5"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
+dependencies = [
+ "aes",
+ "cbc",
+ "der",
+ "pbkdf2",
+ "scrypt",
+ "sha2",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "pkcs5",
+ "rand_core",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.30"
@@ -1349,6 +1779,29 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
@@ -1427,7 +1880,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c82cf8cff14456045f55ec4241383baeff27af886adb72ffb2162f99911de0fd"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
 ]
 
 [[package]]
@@ -1468,25 +1921,74 @@ dependencies = [
  "rand",
 ]
 
+[[package]]
+name = "rsa"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core",
+ "sha2",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "russh-cryptovec"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fadd2c0ab350e21c66556f94ee06f766d8bdae3213857ba7610bfd8e10e51880"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
 [[package]]
 name = "rustix"
 version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
  "windows-sys",
 ]
 
+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "scoped-tls"
 version = "1.0.1"
@@ -1505,13 +2007,24 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a3cf7c11c38cb994f3d40e8a8cde3bbd1f72a435e4c49e85d6553d8312306152"
 
+[[package]]
+name = "scrypt"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
+dependencies = [
+ "pbkdf2",
+ "salsa20",
+ "sha2",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -1605,6 +2118,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core",
+]
+
 [[package]]
 name = "slab"
 version = "0.4.9"
@@ -1620,12 +2143,91 @@ version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
+[[package]]
+name = "socket2"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "ssh-cipher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caac132742f0d33c3af65bfcde7f6aa8f62f0e991d80db99149eb9d44708784f"
+dependencies = [
+ "aes",
+ "aes-gcm",
+ "cbc",
+ "chacha20",
+ "cipher",
+ "ctr",
+ "poly1305",
+ "ssh-encoding",
+ "subtle",
+]
+
+[[package]]
+name = "ssh-encoding"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb9242b9ef4108a78e8cd1a2c98e193ef372437f8c22be363075233321dd4a15"
+dependencies = [
+ "base64ct",
+ "pem-rfc7468",
+ "sha2",
+]
+
+[[package]]
+name = "ssh-key"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca9b366a80cf18bb6406f4cf4d10aebfb46140a8c0c33f666a144c5c76ecbafc"
+dependencies = [
+ "bcrypt-pbkdf",
+ "ed25519-dalek",
+ "num-bigint-dig",
+ "rand_core",
+ "rsa",
+ "sha2",
+ "signature",
+ "ssh-cipher",
+ "ssh-encoding",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "syn"
 version = "2.0.66"
@@ -1679,18 +2281,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.61"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
+checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.61"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
+checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1699,28 +2301,55 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.38.0"
+version = "1.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
+checksum = "e2b070231665d27ad9ec9b8df639893f46727666c6767db40317fbe920a5d998"
 dependencies = [
  "backtrace",
  "bytes",
- "num_cpus",
+ "libc",
+ "mio",
  "pin-project-lite",
+ "socket2",
  "tokio-macros",
+ "windows-sys",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
+checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
+[[package]]
+name = "tokio-stream"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "267ac89e0bec6e691e5813911606935d77c476ff49024f98abcea3e7b15e37af"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "toml"
 version = "0.8.14"
@@ -1823,7 +2452,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89daebc3e6fd160ac4aa9fc8b3bf71e1f74fbf92367ae71fb83a037e8bf164b9"
 dependencies = [
- "memoffset",
+ "memoffset 0.9.1",
  "tempfile",
  "winapi",
 ]
@@ -1846,6 +2475,16 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
 [[package]]
 name = "version-compare"
 version = "0.2.0"
@@ -1884,7 +2523,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e63801c85358a431f986cffa74ba9599ff571fc5774ac113ed3b490c19a1133"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "rustix",
  "wayland-backend",
  "wayland-scanner",
@@ -1896,7 +2535,7 @@ version = "0.31.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f81f365b8b4a97f422ac0e8737c438024b5951734506b0e1d775c73030561f4"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "wayland-backend",
  "wayland-client",
  "wayland-scanner",
@@ -1908,7 +2547,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad1f61b76b6c2d8742e10f9ba5c3737f6530b4c243132c2a2ccc8aa96fe25cd6"
 dependencies = [
- "bitflags",
+ "bitflags 2.5.0",
  "wayland-backend",
  "wayland-client",
  "wayland-protocols",
@@ -2297,6 +2936,12 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+
 [[package]]
 name = "zvariant"
 version = "4.1.2"
diff --git a/apps/desktop/desktop_native/core/Cargo.toml b/apps/desktop/desktop_native/core/Cargo.toml
index d8859208837..e09563fb575 100644
--- a/apps/desktop/desktop_native/core/Cargo.toml
+++ b/apps/desktop/desktop_native/core/Cargo.toml
@@ -13,31 +13,51 @@ manual_test = []
 aes = "=0.8.4"
 anyhow = "=1.0.86"
 arboard = { version = "=3.4.0", default-features = false, features = [
-  "wayland-data-control",
+    "wayland-data-control",
 ] }
+async-stream = "0.3.5"
 base64 = "=0.22.1"
+byteorder = "1.5.0"
 cbc = { version = "=0.1.2", features = ["alloc"] }
+futures = "0.3.30"
+homedir = "0.3.3"
 libc = "=0.2.155"
+pin-project = "1.1.5"
 rand = "=0.8.5"
 retry = "=2.0.0"
+russh-cryptovec = "0.7.3"
 scopeguard = "=1.2.0"
 sha2 = "=0.10.8"
-thiserror = "=1.0.61"
-tokio = { version = "=1.38.0", features = ["io-util", "sync", "macros"] }
+ssh-encoding = "0.2.0"
+ssh-key = { version = "0.6.6", default-features = false, features = [
+    "encryption",
+    "ed25519",
+    "rsa",
+    "getrandom",
+] }
+bitwarden-russh = { git = "https://github.com/bitwarden/bitwarden-russh.git", branch = "km/pm-10098/clean-russh-implementation" }
+thiserror = "=1.0.63"
+tokio = { version = "1.38.0", features = ["io-util", "sync", "macros", "net"] }
+tokio-stream = { version = "0.1.15", features = ["net"] }
+tokio-util = "0.7.11"
 typenum = "=1.17.0"
+rand_chacha = "0.3.1"
+pkcs8 = { version = "0.10.2", features = ["alloc", "encryption", "pem"] }
+rsa = "0.9.6"
+ed25519 = { version = "2.2.3", features = ["pkcs8"] }
 
 [target.'cfg(windows)'.dependencies]
 widestring = "=1.1.0"
 windows = { version = "=0.57.0", features = [
-  "Foundation",
-  "Security_Credentials_UI",
-  "Security_Cryptography",
-  "Storage_Streams",
-  "Win32_Foundation",
-  "Win32_Security_Credentials",
-  "Win32_System_WinRT",
-  "Win32_UI_Input_KeyboardAndMouse",
-  "Win32_UI_WindowsAndMessaging",
+    "Foundation",
+    "Security_Credentials_UI",
+    "Security_Cryptography",
+    "Storage_Streams",
+    "Win32_Foundation",
+    "Win32_Security_Credentials",
+    "Win32_System_WinRT",
+    "Win32_UI_Input_KeyboardAndMouse",
+    "Win32_UI_WindowsAndMessaging",
 ] }
 
 [target.'cfg(windows)'.dev-dependencies]
diff --git a/apps/desktop/desktop_native/core/src/biometric/mod.rs b/apps/desktop/desktop_native/core/src/biometric/mod.rs
index c41ad9dda53..72352cf2288 100644
--- a/apps/desktop/desktop_native/core/src/biometric/mod.rs
+++ b/apps/desktop/desktop_native/core/src/biometric/mod.rs
@@ -6,8 +6,8 @@ use anyhow::{anyhow, Result};
 #[cfg_attr(target_os = "macos", path = "macos.rs")]
 mod biometric;
 
-pub use biometric::Biometric;
 use base64::{engine::general_purpose::STANDARD as base64_engine, Engine};
+pub use biometric::Biometric;
 use sha2::{Digest, Sha256};
 
 use crate::crypto::{self, CipherString};
@@ -42,7 +42,6 @@ pub trait BiometricTrait {
     ) -> Result<String>;
 }
 
-
 fn encrypt(secret: &str, key_material: &KeyMaterial, iv_b64: &str) -> Result<String> {
     let iv = base64_engine
         .decode(iv_b64)?
@@ -77,4 +76,4 @@ impl KeyMaterial {
     pub fn derive_key(&self) -> Result<GenericArray<u8, typenum::U32>> {
         Ok(Sha256::digest(self.digest_material()))
     }
-}
\ No newline at end of file
+}
diff --git a/apps/desktop/desktop_native/core/src/biometric/unix.rs b/apps/desktop/desktop_native/core/src/biometric/unix.rs
index 742b736e812..563bd1dfe52 100644
--- a/apps/desktop/desktop_native/core/src/biometric/unix.rs
+++ b/apps/desktop/desktop_native/core/src/biometric/unix.rs
@@ -5,13 +5,13 @@ use base64::Engine;
 use rand::RngCore;
 use sha2::{Digest, Sha256};
 
-use crate::biometric::{KeyMaterial, OsDerivedKey, base64_engine};
+use crate::biometric::{base64_engine, KeyMaterial, OsDerivedKey};
 use zbus::Connection;
 use zbus_polkit::policykit1::*;
 
 use super::{decrypt, encrypt};
-use anyhow::anyhow;
 use crate::crypto::CipherString;
+use anyhow::anyhow;
 
 /// The Unix implementation of the biometric trait.
 pub struct Biometric {}
@@ -22,13 +22,15 @@ impl super::BiometricTrait for Biometric {
         let proxy = AuthorityProxy::new(&connection).await?;
         let subject = Subject::new_for_owner(std::process::id(), None, None)?;
         let details = std::collections::HashMap::new();
-        let result = proxy.check_authorization(
-            &subject,
-            "com.bitwarden.Bitwarden.unlock",
-            &details,
-            CheckAuthorizationFlags::AllowUserInteraction.into(),
-            "",
-        ).await;
+        let result = proxy
+            .check_authorization(
+                &subject,
+                "com.bitwarden.Bitwarden.unlock",
+                &details,
+                CheckAuthorizationFlags::AllowUserInteraction.into(),
+                "",
+            )
+            .await;
 
         match result {
             Ok(result) => {
@@ -106,4 +108,4 @@ fn random_challenge() -> [u8; 16] {
     let mut challenge = [0u8; 16];
     rand::thread_rng().fill_bytes(&mut challenge);
     challenge
-}
\ No newline at end of file
+}
diff --git a/apps/desktop/desktop_native/core/src/biometric/windows.rs b/apps/desktop/desktop_native/core/src/biometric/windows.rs
index c5db9e3277b..d5e8b6dc915 100644
--- a/apps/desktop/desktop_native/core/src/biometric/windows.rs
+++ b/apps/desktop/desktop_native/core/src/biometric/windows.rs
@@ -160,7 +160,6 @@ impl super::BiometricTrait for Biometric {
     }
 }
 
-
 fn random_challenge() -> [u8; 16] {
     let mut challenge = [0u8; 16];
     rand::thread_rng().fill_bytes(&mut challenge);
diff --git a/apps/desktop/desktop_native/core/src/lib.rs b/apps/desktop/desktop_native/core/src/lib.rs
index d23a285b4ac..921149d41bb 100644
--- a/apps/desktop/desktop_native/core/src/lib.rs
+++ b/apps/desktop/desktop_native/core/src/lib.rs
@@ -3,5 +3,6 @@ pub mod clipboard;
 pub mod crypto;
 pub mod error;
 pub mod password;
-pub mod process_isolation;
 pub mod powermonitor;
+pub mod process_isolation;
+pub mod ssh_agent;
diff --git a/apps/desktop/desktop_native/core/src/password/unix.rs b/apps/desktop/desktop_native/core/src/password/unix.rs
index 53053ee467e..1817a4d62ee 100644
--- a/apps/desktop/desktop_native/core/src/password/unix.rs
+++ b/apps/desktop/desktop_native/core/src/password/unix.rs
@@ -41,7 +41,11 @@ pub fn delete_password(service: &str, account: &str) -> Result<()> {
 }
 
 pub fn is_available() -> Result<bool> {
-    let result = password_clear_sync(Some(&get_schema()), build_attributes("bitwardenSecretsAvailabilityTest", "test"), gio::Cancellable::NONE);
+    let result = password_clear_sync(
+        Some(&get_schema()),
+        build_attributes("bitwardenSecretsAvailabilityTest", "test"),
+        gio::Cancellable::NONE,
+    );
     match result {
         Ok(_) => Ok(true),
         Err(_) => {
diff --git a/apps/desktop/desktop_native/core/src/powermonitor/linux.rs b/apps/desktop/desktop_native/core/src/powermonitor/linux.rs
index fe07ad11ff8..7d0fde15ed4 100644
--- a/apps/desktop/desktop_native/core/src/powermonitor/linux.rs
+++ b/apps/desktop/desktop_native/core/src/powermonitor/linux.rs
@@ -1,6 +1,6 @@
 use std::borrow::Cow;
 
-use zbus::{Connection, MatchRule, export::futures_util::TryStreamExt};
+use zbus::{export::futures_util::TryStreamExt, Connection, MatchRule};
 struct ScreenLock {
     interface: Cow<'static, str>,
     path: Cow<'static, str>,
@@ -42,7 +42,15 @@ pub async fn on_lock(tx: tokio::sync::mpsc::Sender<()>) -> Result<(), Box<dyn st
 pub async fn is_lock_monitor_available() -> bool {
     let connection = Connection::session().await.unwrap();
     for monitor in SCREEN_LOCK_MONITORS {
-        let res = connection.call_method(Some(monitor.interface.clone()), monitor.path.clone(), Some(monitor.interface.clone()), "GetActive", &()).await;
+        let res = connection
+            .call_method(
+                Some(monitor.interface.clone()),
+                monitor.path.clone(),
+                Some(monitor.interface.clone()),
+                "GetActive",
+                &(),
+            )
+            .await;
         if res.is_ok() {
             return true;
         }
diff --git a/apps/desktop/desktop_native/core/src/process_isolation/linux.rs b/apps/desktop/desktop_native/core/src/process_isolation/linux.rs
index ba8734cff7f..dc027e0b546 100644
--- a/apps/desktop/desktop_native/core/src/process_isolation/linux.rs
+++ b/apps/desktop/desktop_native/core/src/process_isolation/linux.rs
@@ -1,7 +1,7 @@
 use anyhow::Result;
-use libc::{c_int, self};
 #[cfg(target_env = "gnu")]
 use libc::c_uint;
+use libc::{self, c_int};
 
 // RLIMIT_CORE is the maximum size of a core dump file. Setting both to 0 disables core dumps, on crashes
 // https://github.com/torvalds/linux/blob/1613e604df0cd359cf2a7fbd9be7a0bcfacfabd0/include/uapi/asm-generic/resource.h#L20
@@ -22,7 +22,10 @@ pub fn disable_coredumps() -> Result<()> {
     };
     if unsafe { libc::setrlimit(RLIMIT_CORE, &rlimit) } != 0 {
         let e = std::io::Error::last_os_error();
-        return Err(anyhow::anyhow!("failed to disable core dumping, memory might be persisted to disk on crashes {}", e))
+        return Err(anyhow::anyhow!(
+            "failed to disable core dumping, memory might be persisted to disk on crashes {}",
+            e
+        ));
     }
 
     Ok(())
@@ -35,7 +38,7 @@ pub fn is_core_dumping_disabled() -> Result<bool> {
     };
     if unsafe { libc::getrlimit(RLIMIT_CORE, &mut rlimit) } != 0 {
         let e = std::io::Error::last_os_error();
-        return Err(anyhow::anyhow!("failed to get core dump limit {}", e))
+        return Err(anyhow::anyhow!("failed to get core dump limit {}", e));
     }
 
     Ok(rlimit.rlim_cur == 0 && rlimit.rlim_max == 0)
@@ -44,7 +47,10 @@ pub fn is_core_dumping_disabled() -> Result<bool> {
 pub fn disable_memory_access() -> Result<()> {
     if unsafe { libc::prctl(PR_SET_DUMPABLE, 0) } != 0 {
         let e = std::io::Error::last_os_error();
-        return Err(anyhow::anyhow!("failed to disable memory dumping, memory is dumpable by other processes {}", e))
+        return Err(anyhow::anyhow!(
+            "failed to disable memory dumping, memory is dumpable by other processes {}",
+            e
+        ));
     }
 
     Ok(())
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/generator.rs b/apps/desktop/desktop_native/core/src/ssh_agent/generator.rs
new file mode 100644
index 00000000000..fe639f20e7f
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/generator.rs
@@ -0,0 +1,45 @@
+use rand::SeedableRng;
+use rand_chacha::ChaCha8Rng;
+use ssh_key::{Algorithm, HashAlg, LineEnding};
+
+use super::importer::SshKey;
+
+pub async fn generate_keypair(key_algorithm: String) -> Result<SshKey, anyhow::Error> {
+    // sourced from cryptographically secure entropy source, with sources for all targets: https://docs.rs/getrandom
+    // if it cannot be securely sourced, this will panic instead of leading to a weak key
+    let mut rng: ChaCha8Rng = ChaCha8Rng::from_entropy();
+
+    let key = match key_algorithm.as_str() {
+        "ed25519" => ssh_key::PrivateKey::random(&mut rng, Algorithm::Ed25519),
+        "rsa2048" | "rsa3072" | "rsa4096" => {
+            let bits = match key_algorithm.as_str() {
+                "rsa2048" => 2048,
+                "rsa3072" => 3072,
+                "rsa4096" => 4096,
+                _ => return Err(anyhow::anyhow!("Unsupported RSA key size")),
+            };
+            let rsa_keypair = ssh_key::private::RsaKeypair::random(&mut rng, bits)
+                .or_else(|e| Err(anyhow::anyhow!(e.to_string())))?;
+
+            let private_key = ssh_key::PrivateKey::new(
+                ssh_key::private::KeypairData::from(rsa_keypair),
+                "".to_string(),
+            )
+            .or_else(|e| Err(anyhow::anyhow!(e.to_string())))?;
+            Ok(private_key)
+        }
+        _ => {
+            return Err(anyhow::anyhow!("Unsupported key algorithm"));
+        }
+    }
+    .or_else(|e| Err(anyhow::anyhow!(e.to_string())))?;
+
+    let private_key_openssh = key
+        .to_openssh(LineEnding::LF)
+        .or_else(|e| Err(anyhow::anyhow!(e.to_string())))?;
+    Ok(SshKey {
+        private_key: private_key_openssh.to_string(),
+        public_key: key.public_key().to_string(),
+        key_fingerprint: key.fingerprint(HashAlg::Sha256).to_string(),
+    })
+}
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/importer.rs b/apps/desktop/desktop_native/core/src/ssh_agent/importer.rs
new file mode 100644
index 00000000000..3d643e764c7
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/importer.rs
@@ -0,0 +1,395 @@
+use ed25519;
+use pkcs8::{
+    der::Decode, EncryptedPrivateKeyInfo, ObjectIdentifier, PrivateKeyInfo, SecretDocument,
+};
+use ssh_key::{
+    private::{Ed25519Keypair, Ed25519PrivateKey, RsaKeypair},
+    HashAlg, LineEnding,
+};
+
+const PKCS1_HEADER: &str = "-----BEGIN RSA PRIVATE KEY-----";
+const PKCS8_UNENCRYPTED_HEADER: &str = "-----BEGIN PRIVATE KEY-----";
+const PKCS8_ENCRYPTED_HEADER: &str = "-----BEGIN ENCRYPTED PRIVATE KEY-----";
+const OPENSSH_HEADER: &str = "-----BEGIN OPENSSH PRIVATE KEY-----";
+
+pub const RSA_PKCS8_ALGORITHM_OID: ObjectIdentifier =
+    ObjectIdentifier::new_unwrap("1.2.840.113549.1.1.1");
+
+#[derive(Debug)]
+enum KeyType {
+    Ed25519,
+    Rsa,
+    Unknown,
+}
+
+pub fn import_key(
+    encoded_key: String,
+    password: String,
+) -> Result<SshKeyImportResult, anyhow::Error> {
+    match encoded_key.lines().next() {
+        Some(PKCS1_HEADER) => {
+            return Ok(SshKeyImportResult {
+                status: SshKeyImportStatus::UnsupportedKeyType,
+                ssh_key: None,
+            });
+        }
+        Some(PKCS8_UNENCRYPTED_HEADER) => {
+            return match import_pkcs8_key(encoded_key, None) {
+                Ok(result) => Ok(result),
+                Err(_) => Ok(SshKeyImportResult {
+                    status: SshKeyImportStatus::ParsingError,
+                    ssh_key: None,
+                }),
+            };
+        }
+        Some(PKCS8_ENCRYPTED_HEADER) => match import_pkcs8_key(encoded_key, Some(password)) {
+            Ok(result) => {
+                return Ok(result);
+            }
+            Err(err) => match err {
+                SshKeyImportError::PasswordRequired => {
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::PasswordRequired,
+                        ssh_key: None,
+                    });
+                }
+                SshKeyImportError::WrongPassword => {
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::WrongPassword,
+                        ssh_key: None,
+                    });
+                }
+                SshKeyImportError::ParsingError => {
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::ParsingError,
+                        ssh_key: None,
+                    });
+                }
+            },
+        },
+        Some(OPENSSH_HEADER) => {
+            return import_openssh_key(encoded_key, password);
+        }
+        Some(_) => {
+            return Ok(SshKeyImportResult {
+                status: SshKeyImportStatus::ParsingError,
+                ssh_key: None,
+            });
+        }
+        None => {
+            return Ok(SshKeyImportResult {
+                status: SshKeyImportStatus::ParsingError,
+                ssh_key: None,
+            });
+        }
+    }
+}
+
+fn import_pkcs8_key(
+    encoded_key: String,
+    password: Option<String>,
+) -> Result<SshKeyImportResult, SshKeyImportError> {
+    let der = match SecretDocument::from_pem(&encoded_key) {
+        Ok((_, doc)) => doc,
+        Err(_) => {
+            return Ok(SshKeyImportResult {
+                status: SshKeyImportStatus::ParsingError,
+                ssh_key: None,
+            });
+        }
+    };
+
+    let decrypted_der = match password.clone() {
+        Some(password) => {
+            let encrypted_private_key_info = match EncryptedPrivateKeyInfo::from_der(der.as_bytes())
+            {
+                Ok(info) => info,
+                Err(_) => {
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::ParsingError,
+                        ssh_key: None,
+                    });
+                }
+            };
+            match encrypted_private_key_info.decrypt(password.as_bytes()) {
+                Ok(der) => der,
+                Err(_) => {
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::WrongPassword,
+                        ssh_key: None,
+                    });
+                }
+            }
+        }
+        None => der,
+    };
+
+    let key_type: KeyType = match PrivateKeyInfo::from_der(decrypted_der.as_bytes())
+        .map_err(|_| SshKeyImportError::ParsingError)?
+        .algorithm
+        .oid
+    {
+        ed25519::pkcs8::ALGORITHM_OID => KeyType::Ed25519,
+        RSA_PKCS8_ALGORITHM_OID => KeyType::Rsa,
+        _ => KeyType::Unknown,
+    };
+
+    match key_type {
+        KeyType::Ed25519 => {
+            let pk: ed25519::KeypairBytes = match password {
+                Some(password) => {
+                    pkcs8::DecodePrivateKey::from_pkcs8_encrypted_pem(&encoded_key, password)
+                        .map_err(|err| match err {
+                            ed25519::pkcs8::Error::EncryptedPrivateKey(_) => {
+                                SshKeyImportError::WrongPassword
+                            }
+                            _ => SshKeyImportError::ParsingError,
+                        })?
+                }
+                None => ed25519::pkcs8::DecodePrivateKey::from_pkcs8_pem(&encoded_key)
+                    .map_err(|_| SshKeyImportError::ParsingError)?,
+            };
+            let pk: Ed25519Keypair =
+                Ed25519Keypair::from(Ed25519PrivateKey::from_bytes(&pk.secret_key));
+            let private_key = ssh_key::private::PrivateKey::from(pk);
+            return Ok(SshKeyImportResult {
+                status: SshKeyImportStatus::Success,
+                ssh_key: Some(SshKey {
+                    private_key: private_key.to_openssh(LineEnding::LF).unwrap().to_string(),
+                    public_key: private_key.public_key().to_string(),
+                    key_fingerprint: private_key.fingerprint(HashAlg::Sha256).to_string(),
+                }),
+            });
+        }
+        KeyType::Rsa => {
+            let pk: rsa::RsaPrivateKey = match password {
+                Some(password) => {
+                    pkcs8::DecodePrivateKey::from_pkcs8_encrypted_pem(&encoded_key, password)
+                        .map_err(|err| match err {
+                            pkcs8::Error::EncryptedPrivateKey(_) => {
+                                SshKeyImportError::WrongPassword
+                            }
+                            _ => SshKeyImportError::ParsingError,
+                        })?
+                }
+                None => pkcs8::DecodePrivateKey::from_pkcs8_pem(&encoded_key)
+                    .map_err(|_| SshKeyImportError::ParsingError)?,
+            };
+            let rsa_keypair: Result<RsaKeypair, ssh_key::Error> = RsaKeypair::try_from(pk);
+            match rsa_keypair {
+                Ok(rsa_keypair) => {
+                    let private_key = ssh_key::private::PrivateKey::from(rsa_keypair);
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::Success,
+                        ssh_key: Some(SshKey {
+                            private_key: private_key
+                                .to_openssh(LineEnding::LF)
+                                .unwrap()
+                                .to_string(),
+                            public_key: private_key.public_key().to_string(),
+                            key_fingerprint: private_key.fingerprint(HashAlg::Sha256).to_string(),
+                        }),
+                    });
+                }
+                Err(_) => {
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::ParsingError,
+                        ssh_key: None,
+                    });
+                }
+            }
+        }
+        _ => {
+            return Ok(SshKeyImportResult {
+                status: SshKeyImportStatus::UnsupportedKeyType,
+                ssh_key: None,
+            });
+        }
+    }
+}
+
+fn import_openssh_key(
+    encoded_key: String,
+    password: String,
+) -> Result<SshKeyImportResult, anyhow::Error> {
+    let private_key = ssh_key::private::PrivateKey::from_openssh(&encoded_key);
+    let private_key = match private_key {
+        Ok(k) => k,
+        Err(err) => {
+            match err {
+                ssh_key::Error::AlgorithmUnknown
+                | ssh_key::Error::AlgorithmUnsupported { algorithm: _ } => {
+                    return Ok(SshKeyImportResult {
+                        status: SshKeyImportStatus::UnsupportedKeyType,
+                        ssh_key: None,
+                    });
+                }
+                _ => {}
+            }
+            return Ok(SshKeyImportResult {
+                status: SshKeyImportStatus::ParsingError,
+                ssh_key: None,
+            });
+        }
+    };
+
+    if private_key.is_encrypted() && password.is_empty() {
+        return Ok(SshKeyImportResult {
+            status: SshKeyImportStatus::PasswordRequired,
+            ssh_key: None,
+        });
+    }
+    let private_key = if private_key.is_encrypted() {
+        match private_key.decrypt(password.as_bytes()) {
+            Ok(k) => k,
+            Err(_) => {
+                return Ok(SshKeyImportResult {
+                    status: SshKeyImportStatus::WrongPassword,
+                    ssh_key: None,
+                });
+            }
+        }
+    } else {
+        private_key
+    };
+
+    match private_key.to_openssh(LineEnding::LF) {
+        Ok(private_key_openssh) => Ok(SshKeyImportResult {
+            status: SshKeyImportStatus::Success,
+            ssh_key: Some(SshKey {
+                private_key: private_key_openssh.to_string(),
+                public_key: private_key.public_key().to_string(),
+                key_fingerprint: private_key.fingerprint(HashAlg::Sha256).to_string(),
+            }),
+        }),
+        Err(_) => Ok(SshKeyImportResult {
+            status: SshKeyImportStatus::ParsingError,
+            ssh_key: None,
+        }),
+    }
+}
+
+#[derive(PartialEq, Debug)]
+pub enum SshKeyImportStatus {
+    /// ssh key was parsed correctly and will be returned in the result
+    Success,
+    /// ssh key was parsed correctly but is encrypted and requires a password
+    PasswordRequired,
+    /// ssh key was parsed correctly, and a password was provided when calling the import, but it was incorrect
+    WrongPassword,
+    /// ssh key could not be parsed, either due to an incorrect / unsupported format (pkcs#8) or key type (ecdsa), or because the input is not an ssh key
+    ParsingError,
+    /// ssh key type is not supported
+    UnsupportedKeyType,
+}
+
+pub enum SshKeyImportError {
+    ParsingError,
+    PasswordRequired,
+    WrongPassword,
+}
+
+pub struct SshKeyImportResult {
+    pub status: SshKeyImportStatus,
+    pub ssh_key: Option<SshKey>,
+}
+
+pub struct SshKey {
+    pub private_key: String,
+    pub public_key: String,
+    pub key_fingerprint: String,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn import_key_ed25519_openssh_unencrypted() {
+        let private_key = include_str!("./test_keys/ed25519_openssh_unencrypted");
+        let public_key = include_str!("./test_keys/ed25519_openssh_unencrypted.pub").trim();
+        let result = import_key(private_key.to_string(), "".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::Success);
+        assert_eq!(result.ssh_key.unwrap().public_key, public_key);
+    }
+
+    #[test]
+    fn import_key_ed25519_openssh_encrypted() {
+        let private_key = include_str!("./test_keys/ed25519_openssh_encrypted");
+        let public_key = include_str!("./test_keys/ed25519_openssh_encrypted.pub").trim();
+        let result = import_key(private_key.to_string(), "password".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::Success);
+        assert_eq!(result.ssh_key.unwrap().public_key, public_key);
+    }
+
+    #[test]
+    fn import_key_rsa_openssh_unencrypted() {
+        let private_key = include_str!("./test_keys/rsa_openssh_unencrypted");
+        let public_key = include_str!("./test_keys/rsa_openssh_unencrypted.pub").trim();
+        let result = import_key(private_key.to_string(), "".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::Success);
+        assert_eq!(result.ssh_key.unwrap().public_key, public_key);
+    }
+
+    #[test]
+    fn import_key_rsa_openssh_encrypted() {
+        let private_key = include_str!("./test_keys/rsa_openssh_encrypted");
+        let public_key = include_str!("./test_keys/rsa_openssh_encrypted.pub").trim();
+        let result = import_key(private_key.to_string(), "password".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::Success);
+        assert_eq!(result.ssh_key.unwrap().public_key, public_key);
+    }
+
+    #[test]
+    fn import_key_ed25519_pkcs8_unencrypted() {
+        let private_key = include_str!("./test_keys/ed25519_pkcs8_unencrypted");
+        let public_key =
+            include_str!("./test_keys/ed25519_pkcs8_unencrypted.pub").replace("testkey", "");
+        let public_key = public_key.trim();
+        let result = import_key(private_key.to_string(), "".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::Success);
+        assert_eq!(result.ssh_key.unwrap().public_key, public_key);
+    }
+
+    #[test]
+    fn import_key_rsa_pkcs8_unencrypted() {
+        let private_key = include_str!("./test_keys/rsa_pkcs8_unencrypted");
+        // for whatever reason pkcs8 + rsa does not include the comment in the public key
+        let public_key =
+            include_str!("./test_keys/rsa_pkcs8_unencrypted.pub").replace("testkey", "");
+        let public_key = public_key.trim();
+        let result = import_key(private_key.to_string(), "".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::Success);
+        assert_eq!(result.ssh_key.unwrap().public_key, public_key);
+    }
+
+    #[test]
+    fn import_key_rsa_pkcs8_encrypted() {
+        let private_key = include_str!("./test_keys/rsa_pkcs8_encrypted");
+        let public_key = include_str!("./test_keys/rsa_pkcs8_encrypted.pub").replace("testkey", "");
+        let public_key = public_key.trim();
+        let result = import_key(private_key.to_string(), "password".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::Success);
+        assert_eq!(result.ssh_key.unwrap().public_key, public_key);
+    }
+
+    #[test]
+    fn import_key_ed25519_openssh_encrypted_wrong_password() {
+        let private_key = include_str!("./test_keys/ed25519_openssh_encrypted");
+        let result = import_key(private_key.to_string(), "wrongpassword".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::WrongPassword);
+    }
+
+    #[test]
+    fn import_non_key_error() {
+        let result = import_key("not a key".to_string(), "".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::ParsingError);
+    }
+
+    #[test]
+    fn import_ecdsa_error() {
+        let private_key = include_str!("./test_keys/ecdsa_openssh_unencrypted");
+        let result = import_key(private_key.to_string(), "".to_string()).unwrap();
+        assert_eq!(result.status, SshKeyImportStatus::UnsupportedKeyType);
+    }
+}
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs b/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs
new file mode 100644
index 00000000000..ad0ac837afc
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs
@@ -0,0 +1,118 @@
+use std::sync::Arc;
+
+use tokio::sync::Mutex;
+use tokio_util::sync::CancellationToken;
+
+use bitwarden_russh::ssh_agent::{self, Key};
+
+#[cfg_attr(target_os = "windows", path = "windows.rs")]
+#[cfg_attr(target_os = "macos", path = "unix.rs")]
+#[cfg_attr(target_os = "linux", path = "unix.rs")]
+mod platform_ssh_agent;
+
+pub mod generator;
+pub mod importer;
+
+#[derive(Clone)]
+pub struct BitwardenDesktopAgent {
+    keystore: ssh_agent::KeyStore,
+    cancellation_token: CancellationToken,
+    show_ui_request_tx: tokio::sync::mpsc::Sender<(u32, String)>,
+    get_ui_response_rx: Arc<Mutex<tokio::sync::broadcast::Receiver<(u32, bool)>>>,
+    request_id: Arc<Mutex<u32>>,
+}
+
+impl BitwardenDesktopAgent {
+    async fn get_request_id(&self) -> u32 {
+        let mut request_id = self.request_id.lock().await;
+        *request_id += 1;
+        *request_id
+    }
+}
+
+impl ssh_agent::Agent for BitwardenDesktopAgent {
+    async fn confirm(&self, ssh_key: Key) -> bool {
+        let request_id = self.get_request_id().await;
+
+        let mut rx_channel = self.get_ui_response_rx.lock().await.resubscribe();
+        self.show_ui_request_tx
+            .send((request_id, ssh_key.cipher_uuid.clone()))
+            .await
+            .expect("Should send request to ui");
+        while let Ok((id, response)) = rx_channel.recv().await {
+            if id == request_id {
+                return response;
+            }
+        }
+        false
+    }
+}
+
+impl BitwardenDesktopAgent {
+    pub fn stop(&self) {
+        self.cancellation_token.cancel();
+        self.keystore
+            .0
+            .write()
+            .expect("RwLock is not poisoned")
+            .clear();
+    }
+
+    pub fn set_keys(
+        &mut self,
+        new_keys: Vec<(String, String, String)>,
+    ) -> Result<(), anyhow::Error> {
+        let keystore = &mut self.keystore;
+        keystore.0.write().expect("RwLock is not poisoned").clear();
+
+        for (key, name, cipher_id) in new_keys.iter() {
+            match parse_key_safe(&key) {
+                Ok(private_key) => {
+                    let public_key_bytes = private_key
+                        .public_key()
+                        .to_bytes()
+                        .expect("Cipher private key is always correctly parsed");
+                    keystore.0.write().expect("RwLock is not poisoned").insert(
+                        public_key_bytes,
+                        Key {
+                            private_key: Some(private_key),
+                            name: name.clone(),
+                            cipher_uuid: cipher_id.clone(),
+                        },
+                    );
+                }
+                Err(e) => {
+                    eprintln!("[SSH Agent Native Module] Error while parsing key: {}", e);
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    pub fn lock(&mut self) -> Result<(), anyhow::Error> {
+        let keystore = &mut self.keystore;
+        keystore
+            .0
+            .write()
+            .expect("RwLock is not poisoned")
+            .iter_mut()
+            .for_each(|(_public_key, key)| {
+                key.private_key = None;
+            });
+        Ok(())
+    }
+}
+
+fn parse_key_safe(pem: &str) -> Result<ssh_key::private::PrivateKey, anyhow::Error> {
+    match ssh_key::private::PrivateKey::from_openssh(pem) {
+        Ok(key) => match key.public_key().to_bytes() {
+            Ok(_) => Ok(key),
+            Err(e) => Err(anyhow::Error::msg(format!(
+                "Failed to parse public key: {}",
+                e
+            ))),
+        },
+        Err(e) => Err(anyhow::Error::msg(format!("Failed to parse key: {}", e))),
+    }
+}
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/named_pipe_listener_stream.rs b/apps/desktop/desktop_native/core/src/ssh_agent/named_pipe_listener_stream.rs
new file mode 100644
index 00000000000..69399ae7530
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/named_pipe_listener_stream.rs
@@ -0,0 +1,60 @@
+use std::{
+    io,
+    pin::Pin,
+    task::{Context, Poll},
+};
+
+use futures::Stream;
+use tokio::{
+    net::windows::named_pipe::{NamedPipeServer, ServerOptions},
+    select,
+};
+use tokio_util::sync::CancellationToken;
+
+const PIPE_NAME: &str = r"\\.\pipe\openssh-ssh-agent";
+
+#[pin_project::pin_project]
+pub struct NamedPipeServerStream {
+    rx: tokio::sync::mpsc::Receiver<NamedPipeServer>,
+}
+
+impl NamedPipeServerStream {
+    pub fn new(cancellation_token: CancellationToken) -> Self {
+        let (tx, rx) = tokio::sync::mpsc::channel(16);
+        tokio::spawn(async move {
+            println!(
+                "[SSH Agent Native Module] Creating named pipe server on {}",
+                PIPE_NAME
+            );
+            let mut listener = ServerOptions::new().create(PIPE_NAME).unwrap();
+            loop {
+                println!("[SSH Agent Native Module] Waiting for connection");
+                select! {
+                    _ = cancellation_token.cancelled() => {
+                        println!("[SSH Agent Native Module] Cancellation token triggered, stopping named pipe server");
+                        break;
+                    }
+                    _ = listener.connect() => {
+                        println!("[SSH Agent Native Module] Incoming connection");
+                        tx.send(listener).await.unwrap();
+                        listener = ServerOptions::new().create(PIPE_NAME).unwrap();
+                    }
+                }
+            }
+        });
+        Self { rx }
+    }
+}
+
+impl Stream for NamedPipeServerStream {
+    type Item = io::Result<NamedPipeServer>;
+
+    fn poll_next(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<io::Result<NamedPipeServer>>> {
+        let this = self.project();
+
+        this.rx.poll_recv(cx).map(|v| v.map(Ok))
+    }
+}
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted
new file mode 100644
index 00000000000..9cf518f8af7
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted
@@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRQzzQ8nQEouF1FMSHkPx1nejNCzF7g
+Yb8MHXLdBFM0uJkWs0vzgLJkttts2eDv3SHJqIH6qHpkLtEvgMXE5WcaAAAAoOO1BebjtQ
+XmAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFDPNDydASi4XUUx
+IeQ/HWd6M0LMXuBhvwwdct0EUzS4mRazS/OAsmS222zZ4O/dIcmogfqoemQu0S+AxcTlZx
+oAAAAhAKnIXk6H0Hs3HblklaZ6UmEjjdE/0t7EdYixpMmtpJ4eAAAAB3Rlc3RrZXk=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted.pub
new file mode 100644
index 00000000000..75e08b88b2f
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ecdsa_openssh_unencrypted.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFDPNDydASi4XUUxIeQ/HWd6M0LMXuBhvwwdct0EUzS4mRazS/OAsmS222zZ4O/dIcmogfqoemQu0S+AxcTlZxo= testkey
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted
new file mode 100644
index 00000000000..d3244a3d945
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted
@@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAUTNb0if
+fqsoqtfv70CfukAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIHGs3Uw3eyqnFjBI
+2eb7Qto4KVc34ZdnBac59Bab54BLAAAAkPA6aovfxQbP6FoOfaRH6u22CxqiUM0bbMpuFf
+WETn9FLaBE6LjoHH0ZI5rzNjJaQUNfx0cRcqsIrexw8YINrdVjySmEqrl5hw8gpgy0gGP5
+1Y6vKWdHdrxJCA9YMFOfDs0UhPfpLKZCwm2Sg+Bd8arlI8Gy7y4Jj/60v2bZOLhD2IZQnK
+NdJ8xATiIINuTy4g==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted.pub
new file mode 100644
index 00000000000..1188fa43f1e
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_encrypted.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHGs3Uw3eyqnFjBI2eb7Qto4KVc34ZdnBac59Bab54BL testkey
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted
new file mode 100644
index 00000000000..08184f3184e
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAyQo22TXXNqvF+L8jUSSNeu8UqrsDjvf9pwIwDC9ML6gAAAJDSHpL60h6S
++gAAAAtzc2gtZWQyNTUxOQAAACAyQo22TXXNqvF+L8jUSSNeu8UqrsDjvf9pwIwDC9ML6g
+AAAECLdlFLIJbEiFo/f0ROdXMNZAPHGPNhvbbftaPsUZEjaDJCjbZNdc2q8X4vyNRJI167
+xSquwOO9/2nAjAML0wvqAAAAB3Rlc3RrZXkBAgMEBQY=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted.pub
new file mode 100644
index 00000000000..5c398822022
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_openssh_unencrypted.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDJCjbZNdc2q8X4vyNRJI167xSquwOO9/2nAjAML0wvq testkey
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted
new file mode 100644
index 00000000000..09eb728601e
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted
@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MFECAQEwBQYDK2VwBCIEIDY6/OAdDr3PbDss9NsLXK4CxiKUvz5/R9uvjtIzj4Sz
+gSEAxsxm1xpZ/4lKIRYm0JrJ5gRZUh7H24/YT/0qGVGzPa0=
+-----END PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted.pub
new file mode 100644
index 00000000000..40997e18c89
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/ed25519_pkcs8_unencrypted.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMbMZtcaWf+JSiEWJtCayeYEWVIex9uP2E/9KhlRsz2t
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted
new file mode 100644
index 00000000000..bb7bbd85cf9
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted
@@ -0,0 +1,39 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABApatKZWf
+0kXnaSVhty/RaKAAAAGAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQC/v18xGP3q
+zRV9iWqyiuwHZ4GpC4K2NO2/i2Yv5A3/bnal7CmiMh/S78lphgxcWtFkwrwlb321FmdHBv
+6KOW+EzSiPvmsdkkbpfBXB3Qf2SlhZOZZ7lYeu8KAxL3exvvn8O1GGlUjXGUrFgmC60tHW
+DBc1Ncmo8a2dwDLmA/sbLa8su2dvYEFmRg1vaytLDpkn8GS7zAxrUl/g0W2RwkPsByduUz
+iQuX90v9WAy7MqOlwBRq6t5o8wdDBVODe0VIXC7N1OS42YUsKF+N0XOnLiJrIIKkXpahMD
+pKZHeHQAdUQzsJVhKoLJR8DNDTYyhnJoQG7Q6m2gDTca9oAWvsBiNoEwCvwrt7cDNCz/Gs
+lH9HXQgfWcVXn8+fuZgvjO3CxUI16Ev33m0jWoOKJcgK/ZLRnk8SEvsJ8NO32MeR/qUb7I
+N/yUcDmPMI/3ecQsakF2cwNzHkyiGVo//yVTpf+vk8b89L+GXbYU5rtswtc2ZEGsQnUkao
+NqS8mHqhWQBUkAAAWArmugDAR1KlxY8c/esWbgQ4oP/pAQApehDcFYOrS9Zo78Os4ofEd1
+HkgM7VG1IJafCnn+q+2VXD645zCsx5UM5Y7TcjYDp7reM19Z9JCidSVilleRedTj6LTZx1
+SvetIrTfr81SP6ZGZxNiM0AfIZJO5vk+NliDdbUibvAuLp3oYbzMS3syuRkJePWu+KSxym
+nm2+88Wku94p6SIfGRT3nQsMfLS9x6fGQP5Z71DM91V33WCVhrBnvHgNxuAzHDZNfzbPu9
+f2ZD1JGh8azDPe0XRD2jZTyd3Nt+uFMcwnMdigTXaTHExEFkTdQBea1YoprIG56iNZTSoU
+/RwE4A0gdrSgJnh+6p8w05u+ia0N2WSL5ZT9QydPhwB8pGHuGBYoXFcAcFwCnIAExPtIUh
+wLx1NfC/B2MuD3Uwbx96q5a7xMTH51v0eQDdY3mQzdq/8OHHn9vzmEfV6mxmuyoa0Vh+WG
+l2WLB2vD5w0JwRAFx6a3m/rD7iQLDvK3UiYJ7DVz5G3/1w2m4QbXIPCfI3XHU12Pye2a0m
+/+/wkS4/BchqB0T4PJm6xfEynXwkEolndf+EvuLSf53XSJ2tfeFPGmmCyPoy9JxCce7wVk
+FB/SJw6LXSGUO0QA6vzxbzLEMNrqrpcCiUvDGTA6jds0HnSl8hhgMuZOtQDbFoovIHX0kl
+I5pD5pqaUNvQ3+RDFV3qdZyDntaPwCNJumfqUy46GAhYVN2O4p0HxDTs4/c2rkv+fGnG/P
+8wc7ACz3QNdjb7XMrW3/vNuwrh/sIjNYM2aiVWtRNPU8bbSmc1sYtpJZ5CsWK1TNrDrY6R
+OV89NjBoEC5OXb1c75VdN/jSssvn72XIHjkkDEPboDfmPe889VHfsVoBm18uvWPB4lffdm
+4yXAr+Cx16HeiINjcy6iKym2p4ED5IGaSXlmw/6fFgyh2iF7kZTnHawVPTqJNBVMaBRvHn
+ylMBLhhEkrXqW43P4uD6l0gWCAPBczcSjHv3Yo28ExtI0QKNk/Uwd2q2kxFRWCtqUyQkrF
+KG9IK+ixqstMo+xEb+jcCxCswpJitEIrDOXd51sd7PjCGZtAQ6ycpOuFfCIhwxlBUZdf2O
+kM/oKqN/MKMDk+H/OVl8XrLalBOXYDllW+NsL8W6F8DMcdurpQ8lCJHHWBgOdNd62STdvZ
+LBf7v8OIrC6F0bVGushsxb7cwGiUrjqUfWjhZoKx35V0dWBcGx7GvzARkvSUM22q14lc7+
+XTP0qC8tcRQfRbnBPJdmnbPDrJeJcDv2ZdbAPdzf2C7cLuuP3mNwLCrLUc7gcF/xgH+Xtd
+6KOvzt2UuWv5+cqWOsNspG+lCY0P11BPhlMvmZKO8RGVGg7PKAatG4mSH4IgO4DN2t7U9B
+j+v2jq2z5O8O4yJ8T2kWnBlhWzlBoL+R6aaat421f0v+tW/kEAouBQob5I0u1VLB2FkpZE
+6tOCK47iuarhf/86NtlPfCM9PdWJQOKcYQ8DCQhp5Lvgd0Vj3WzY+BISDdB2omGRhLUly/
+i40YPASAVnWvgqpCQ4E3rs4DWI/kEcvQH8zVq2YoRa6fVrVf1w/GLFC7m/wkxw8fDfZgMS
+Mu+ygbFa9H3aOSZMpTXhdssbOhU70fZOe6GWY9kLBNV4trQeb/pRdbEbMtEmN5TLESgwLA
+43dVdHjvpZS677FN/d9+q+pr0Xnuc2VdlXkUyOyv1lFPJIN/XIotiDTnZ3epQQ1zQ3mx32
+8Op2EVgFWpwNmGXJ1zCCA6loUG7e4W/iXkKQxTvOM0fmE4a1Y387GDwJ+pZevYOIOYTkTa
+l5jM/6Wm3pLNyE8Ynw3OX0T/p9TO1i3DlXXE/LzcWJFFXAQMo+kc+GlXqjP7K7c6xjQ6vx
+2MmKBw==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted.pub
new file mode 100644
index 00000000000..d37f573b686
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_encrypted.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/v18xGP3qzRV9iWqyiuwHZ4GpC4K2NO2/i2Yv5A3/bnal7CmiMh/S78lphgxcWtFkwrwlb321FmdHBv6KOW+EzSiPvmsdkkbpfBXB3Qf2SlhZOZZ7lYeu8KAxL3exvvn8O1GGlUjXGUrFgmC60tHWDBc1Ncmo8a2dwDLmA/sbLa8su2dvYEFmRg1vaytLDpkn8GS7zAxrUl/g0W2RwkPsByduUziQuX90v9WAy7MqOlwBRq6t5o8wdDBVODe0VIXC7N1OS42YUsKF+N0XOnLiJrIIKkXpahMDpKZHeHQAdUQzsJVhKoLJR8DNDTYyhnJoQG7Q6m2gDTca9oAWvsBiNoEwCvwrt7cDNCz/GslH9HXQgfWcVXn8+fuZgvjO3CxUI16Ev33m0jWoOKJcgK/ZLRnk8SEvsJ8NO32MeR/qUb7IN/yUcDmPMI/3ecQsakF2cwNzHkyiGVo//yVTpf+vk8b89L+GXbYU5rtswtc2ZEGsQnUkaoNqS8mHqhWQBUk= testkey
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted
new file mode 100644
index 00000000000..0d2692e14a2
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted
@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAtVIe0gnPtD6299/roT7ntZgVe+qIqIMIruJdI2xTanLGhNpBOlzg
+WqokbQK+aXATcaB7iQL1SPxIWV2M4jEBQbZuimIgDQvKbJ4TZPKEe1VdsrfuIo+9pDK7cG
+Kc+JiWhKjqeTRMj91/qR1fW5IWOUyE1rkwhTNkwJqtYKZLVmd4TXtQsYMMC+I0cz4krfk1
+Yqmaae/gj12h8BvE3Y+Koof4JoLsqPufH+H/bVEayv63RyAQ1/tUv9l+rwJ+svWV4X3zf3
+z40hGF43L/NGl90Vutbn7b9G/RgEdiXyLZciP3XbWbLUM+r7mG9KNuSeoixe5jok15UKqC
+XXxVb5IEZ73kaubSfz9JtsqtKG/OjOq6Fbl3Ky7kjvJyGpIvesuSInlpzPXqbLUCLJJfOA
+PUZ1wi8uuuRNePzQBMMhq8UtAbB2Dy16d+HlgghzQ00NxtbQMfDZBdApfxm3shIxkUcHzb
+DSvriHVaGGoOkmHPAmsdMsMiekuUMe9ljdOhmdTxAAAFgF8XjBxfF4wcAAAAB3NzaC1yc2
+EAAAGBALVSHtIJz7Q+tvff66E+57WYFXvqiKiDCK7iXSNsU2pyxoTaQTpc4FqqJG0Cvmlw
+E3Gge4kC9Uj8SFldjOIxAUG2bopiIA0LymyeE2TyhHtVXbK37iKPvaQyu3BinPiYloSo6n
+k0TI/df6kdX1uSFjlMhNa5MIUzZMCarWCmS1ZneE17ULGDDAviNHM+JK35NWKpmmnv4I9d
+ofAbxN2PiqKH+CaC7Kj7nx/h/21RGsr+t0cgENf7VL/Zfq8CfrL1leF98398+NIRheNy/z
+RpfdFbrW5+2/Rv0YBHYl8i2XIj9121my1DPq+5hvSjbknqIsXuY6JNeVCqgl18VW+SBGe9
+5Grm0n8/SbbKrShvzozquhW5dysu5I7ychqSL3rLkiJ5acz16my1AiySXzgD1GdcIvLrrk
+TXj80ATDIavFLQGwdg8tenfh5YIIc0NNDcbW0DHw2QXQKX8Zt7ISMZFHB82w0r64h1Whhq
+DpJhzwJrHTLDInpLlDHvZY3ToZnU8QAAAAMBAAEAAAGAEL3wpRWtVTf+NnR5QgX4KJsOjs
+bI0ABrVpSFo43uxNMss9sgLzagq5ZurxcUBFHKJdF63puEkPTkbEX4SnFaa5of6kylp3a5
+fd55rXY8F9Q5xtT3Wr8ZdFYP2xBr7INQUJb1MXRMBnOeBDw3UBH01d0UHexzB7WHXcZacG
+Ria+u5XrQebwmJ3PYJwENSaTLrxDyjSplQy4QKfgxeWNPWaevylIG9vtue5Xd9WXdl6Szs
+ONfD3mFxQZagPSIWl0kYIjS3P2ZpLe8+sakRcfci8RjEUP7U+QxqY5VaQScjyX1cSYeQLz
+t+/6Tb167aNtQ8CVW3IzM2EEN1BrSbVxFkxWFLxogAHct06Kn87nPn2+PWGWOVCBp9KheO
+FszWAJ0Kzjmaga2BpOJcrwjSpGopAb1YPIoRPVepVZlQ4gGwy5gXCFwykT9WTBoJfg0BMQ
+r3MSNcoc97eBomIWEa34K0FuQ3rVjMv9ylfyLvDBbRqTJ5zebeOuU+yCQHZUKk8klRAAAA
+wAsToNZvYWRsOMTWQom0EW1IHzoL8Cyua+uh72zZi/7enm4yHPJiu2KNgQXfB0GEEjHjbo
+9peCW3gZGTV+Ee+cAqwYLlt0SMl/VJNxN3rEG7BAqPZb42Ii2XGjaxzFq0cliUGAdo6UEd
+swU8d2I7m9vIZm4nDXzsWOBWgonTKBNyL0DQ6KNOGEyj8W0BTCm7Rzwy7EKzFWbIxr4lSc
+vDrJ3t6kOd7jZTF58kRMT0nxR0bf43YzF/3/qSvLYhQm/OOAAAAMEA2F6Yp8SrpQDNDFxh
+gi4GeywArrQO9r3EHjnBZi/bacxllSzCGXAvp7m9OKC1VD2wQP2JL1VEIZRUTuGGT6itrm
+QpX8OgoxlEJrlC5W0kHumZ3MFGd33W11u37gOilmd6+VfVXBziNG2rFohweAgs8X+Sg5AA
+nIfMV6ySXUlvLzMHpGeKRRnnQq9Cwn4rDkVQENLd1i4e2nWFhaPTUwVMR8YuOT766bywr3
+7vG1PQLF7hnf2c/oPHAru+XD9gJWs5AAAAwQDWiB2G23F4Tvq8FiK2mMusSjQzHupl83rm
+o3BSNRCvCjaLx6bWhDPSA1edNEF7VuP6rSp+i+UfSORHwOnlgnrvtcJeoDuA72hUeYuqD/
+1C9gghdhKzGTVf/IGTX1tH3rn2Gq9TEyrJs/ITcoOyZprz7VbaD3bP/NEER+m1EHi2TS/3
+SXQEtRm+IIBwba+QLUcsrWdQyIO+1OCXywDrAw50s7tjgr/goHgXTcrSXaKcIEOlPgBZH3
+YPuVuEtRYgX3kAAAAHdGVzdGtleQECAwQ=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted.pub
new file mode 100644
index 00000000000..9ec8fec5c58
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_openssh_unencrypted.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC1Uh7SCc+0Prb33+uhPue1mBV76oiogwiu4l0jbFNqcsaE2kE6XOBaqiRtAr5pcBNxoHuJAvVI/EhZXYziMQFBtm6KYiANC8psnhNk8oR7VV2yt+4ij72kMrtwYpz4mJaEqOp5NEyP3X+pHV9bkhY5TITWuTCFM2TAmq1gpktWZ3hNe1CxgwwL4jRzPiSt+TViqZpp7+CPXaHwG8Tdj4qih/gmguyo+58f4f9tURrK/rdHIBDX+1S/2X6vAn6y9ZXhffN/fPjSEYXjcv80aX3RW61uftv0b9GAR2JfItlyI/ddtZstQz6vuYb0o25J6iLF7mOiTXlQqoJdfFVvkgRnveRq5tJ/P0m2yq0ob86M6roVuXcrLuSO8nIaki96y5IieWnM9epstQIskl84A9RnXCLy665E14/NAEwyGrxS0BsHYPLXp34eWCCHNDTQ3G1tAx8NkF0Cl/GbeyEjGRRwfNsNK+uIdVoYag6SYc8Cax0ywyJ6S5Qx72WN06GZ1PE= testkey
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted
new file mode 100644
index 00000000000..e84d1f07a31
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted
@@ -0,0 +1,42 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIHdTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQXquAya5XFx11QEPm
+KCSnlwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEAQIEEKVtEIkI2ELppfUQ
+IwfNzowEggcQtWhXVz3LunYTSRVgnexcHEaGkUF6l6a0mGaLSczl+jdCwbbBxibU
+EvN7+WMQ44shOk3LyThg0Irl22/7FuovmYc3TSeoMQH4mTROKF+9793v0UMAIAYd
+ZhTsexTGncCOt//bq6Fl+L+qPNEkY/OjS+wI9MbOn/Agbcr8/IFSOxuSixxoTKgq
+4QR5Ra3USCLyfm+3BoGPMk3tbEjrwjvzx/eTaWzt6hdc0yX4ehtqExF8WAYB43DW
+3Y1slA1T464/f1j4KXhoEXDTBOuvNvnbr7lhap8LERIGYGnQKv2m2Kw57Wultnoe
+joEQ+vTl5n92HI77H8tbgSbTYuEQ2n9pDD7AAzYGBn15c4dYEEGJYdHnqfkEF+6F
+EgPa+Xhj2qqk5nd1bzPSv6iX7XfAX2sRzfZfoaFETmR0ZKbs0aMsndC5wVvd3LpA
+m86VUihQxDvU8F4gizrNYj4NaNRv4lrxBj7Kb6BO/qT3DB8Uqu43oyrvA90iMigi
+EvuCViwwhwCpe+AxCqLGrzvIpiZCksTOtSPEvnMehw2WA3yd/n88Nis5zD4b65+q
+Tx9Q0Qm1LIi1Bq+s60+W1HK3KfaLrJaoX3JARZoWfxurZwtj+cMlo5zK1Ha2HHqQ
+kVn21tOcQU/Yljt3Db+CKZ5Tos/rPywxGnkeMABzJgyajPHkYaSgWZrOEueihfS1
+5eDtEMBehEyHfcUrL7XGnn4lOzwQHZIEFnVdV0YGaQY8Wz212IjeWxV09gM2OEP6
+PEDI3GSsqOnGkPrnson5tsIUcvpk9smy9AA9qVhNowzeWCWmsF8K9fn/O94tIzyN
+2EK0tkf8oDVROlbEh/jDa2aAHqPGCXBEqq1CbZXQpNk4FlRzkjtxdzPNiXLf45xO
+IjOTTzgaVYWiKZD9ymNjNPIaDCPB6c4LtUm86xUQzXdztBm1AOI3PrNI6nIHxWbF
+bPeEkJMRiN7C9j5nQMgQRB67CeLhzvqUdyfrYhzc7HY479sKDt9Qn8R0wpFw0QSA
+G1gpGyxFaBFSdIsil5K4IZYXxh7qTlOKzaqArTI0Dnuk8Y67z8zaxN5BkvOfBd+Q
+SoDz6dzn7KIJrK4XP3IoNfs6EVT/tlMPRY3Y/Ug+5YYjRE497cMxW8jdf3ZwgWHQ
+JubPH+0IpwNNZOOf4JXALULsDj0N7rJ1iZAY67b+7YMin3Pz0AGQhQdEdqnhaxPh
+oMvL9xFewkyujwCmPj1oQi1Uj2tc1i4ZpxY0XmYn/FQiQH9/XLdIlOMSTwGx86bw
+90e9VJHfCmflLOpENvv5xr2isNbn0aXNAOQ4drWJaYLselW2Y4N1iqBCWJKFyDGw
+4DevhhamEvsrdoKgvnuzfvA44kQGmfTjCuMu7IR5zkxevONNrynKcHkoWATzgxSS
+leXCxzc9VA0W7XUSMypHGPNHJCwYZvSWGx0qGI3VREUk2J7OeVjXCFNeHFc2Le3P
+dAm+DqRiyPBVX+yW+i7rjZLyypLzmYo9CyhlohOxTeGa6iTxBUZfYGoc0eJNqfgN
+/5hkoPFYGkcd/p41SKSg7akrJPRc+uftH0oVI0wVorGSVOvwXRn7QM+wFKlv3DQD
+ysMP7cOKqMyhJsqeW74/iWEmhbFIDKexSd/KTQ6PirVlzj7148Fl++yxaZpnZ6MY
+iyzifvLcT701GaewIwi9YR9f1BWUXYHTjK3sB3lLPyMbA4w9bRkylcKrbGf85q0E
+LXPlfh+1C9JctczDCqr2iLRoc/5j23GeN8RWfUNpZuxjFv9sxkV4iG+UapIuOBIc
+Os4//3w24XcTXYqBdX2Y7+238xq6/94+4hIhXAcMFc2Nr3CEAZCuKYChVL9CSA3v
+4sZM4rbOz6kWTC2G3SAtkLSk7hCJ6HLXzrnDb4++g3JYJWLeaQ+4ZaxWuKymnehN
+xumXCwCn0stmCjXYV/yM3TeVnMfBTIB13KAjbn0czGW00nj79rNJJzkOlp9tIPen
+pUPRFPWjgLF+hVQrwqJ3HPmt6Rt6mKzZ4FEpBXMDjvlKabnFvBdl3gbNHSfxhGHi
+FzG3phg1CiXaURQUAf21PV+djfBha7kDwMXnpgZ+PIyGDxRj61StV/NSlhg+8GrL
+ccoDOkfpy2zn++rmAqA21rTEChFN5djdsJw45GqPKUPOAgxKBsvqpoMIqq/C2pHP
+iMiBriZULV9l0tHn5MMcNQbYAmp4BsTo6maHByAVm1/7/VPQn6EieuGroYgSk2H7
+pnwM01IUfGGP3NKlq9EiiF1gz8acZ5v8+jkZM2pIzh8Trw0mtwBpnyiyXmpbR/RG
+m/TTU/gNQ/94ZaNJ/shPoBwikWXvOm+0Z0ZAwu3xefTyENGhjmb5GXshEN/5WwCm
+NNrtUPlkGkYJrnSCVM/lHtjShwbLw2w/1sag1uDuXwirxxYh9r7D6HQ=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted.pub
new file mode 100644
index 00000000000..f3c1b15f0a3
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_encrypted.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCcHkc0xfH4w9aW41S9M/BfancSY4QPc2O4G1cRjFfK8QrLEGDA7NiHtoEML0afcurRXD3NVxuKaAns0w6EoS4CjzXUqVHTLA4SUyuapr8k0Eu2xOpbCwC3jDovhckoKloq7BvE6rC2i5wjSMadtIJKt/dqWI3HLjUMz1BxQJAU/qAbicj1SFZSjA/MubVBzcq93XOvByMtlIFu7wami3FTc37rVkGeUFHtK8ZbvG3n1aaTF79bBgSPuoq5BfcMdGr4WfQyGQzgse4v4hQ8yKYrtE0jo0kf06hEORimwOIU/W5IH1r+/xFs7qGKcPnFSZRIFv5LfMPTo8b+OsBRflosyfUumDEX97GZE7DSQl0EJzNvWeKwl7dQ8RUJTkbph2CjrxY77DFim+165Uj/WRr4uq2qMNhA2xNSD19+TA6AHdpGw4WZd37q2/n+EddlaJEH8MzpgtHNG9MiYh5ScZ+AG0QugflozJcQNc7n8N9Lpu1sRoejV5RhurHg/TYwVK8= testkey
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted
new file mode 100644
index 00000000000..0bfe2bc5067
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQCn4+QiJojZ9mgc
+9KYJIvDWGaz4qFhf0CButg6L8zEoHKwuiN+mqcEciCCOa9BNiJmm8NTTehZvrrgl
+GG59zIbqYtDAHjVn+vtb49xPzIv+M651Yqj08lIbR9tEIHKCq7aH8GlDm8NgG9Ez
+JGjlL7okQym4TH1MHl+s4mUyr/qb2unlZBDixAQsphU8iCLftukWCIkmQg4CSj1G
+h3WbBlZ+EX5eW0EXuAw4XsSbBTWV9CHRowVIpYqPvEYSpHsoCjEcd988p19hpiGk
+nA0J4z7JfUlNgyT/1chb8GCTDT+2DCBRApbsIg6TOBVS+PR6emAQ3eZzUW0+3/oR
+M4ip0ujltQy8uU6gvYIAqx5wXGMThVpZcUgahKiSsVo/s4b84iMe4DG3W8jz4qi6
+yyNv0VedEzPUZ1lXd1GJFoy9uKNuSTe+1ksicAcluZN6LuNsPHcPxFCzOcmoNnVX
+EKAXInt+ys//5CDVasroZSAHZnDjUD4oNsLI3VIOnGxgXrkwSH0CAwEAAQKCAYAA
+2SDMf7OBHw1OGM9OQa1ZS4u+ktfQHhn31+FxbrhWGp+lDt8gYABVf6Y4dKN6rMtn
+7D9gVSAlZCAn3Hx8aWAvcXHaspxe9YXiZDTh+Kd8EIXxBQn+TiDA5LH0dryABqmM
+p20vYKtR7OS3lIIXfFBSrBMwdunKzLwmKwZLWq0SWf6vVbwpxRyR9CyByodF6Djm
+ZK3QB2qQ3jqlL1HWXL0VnyArY7HLvUvfLLK4vMPqnsSH+FdHvhcEhwqMlWT44g+f
+hqWtCJNnjDgLK3FPbI8Pz9TF8dWJvOmp5Q6iSBua1e9x2LizVuNSqiFc7ZTLeoG4
+nDj7T2BtqB0E1rNUDEN1aBo+UZmHJK7LrzfW/B+ssi2WwIpfxYa1lO6HFod5/YQi
+XV1GunyH1chCsbvOFtXvAHASO4HTKlJNbWhRF1GXqnKpAaHDPCVuwp3eq6Yf0oLb
+XrL3KFZ3jwWiWbpQXRVvpqzaJwZn3CN1yQgYS9j17a9wrPky+BoJxXjZ/oImWLEC
+gcEA0lkLwiHvmTYFTCC7PN938Agk9/NQs5PQ18MRn9OJmyfSpYqf/gNp+Md7xUgt
+F/MTif7uelp2J7DYf6fj9EYf9g4EuW+SQgFP4pfiJn1+zGFeTQq1ISvwjsA4E8ZS
+t+GIumjZTg6YiL1/A79u4wm24swt7iqnVViOPtPGOM34S1tAamjZzq2eZDmAF6pA
+fmuTMdinCMR1E1kNJYbxeqLiqQCXuwBBnHOOOJofN3AkvzjRUBB9udvniqYxH3PQ
+cxPxAoHBAMxT5KwBhZhnJedYN87Kkcpl7xdMkpU8b+aXeZoNykCeoC+wgIQexnSW
+mFk4HPkCNxvCWlbkOT1MHrTAKFnaOww23Ob+Vi6A9n0rozo9vtoJig114GB0gUqE
+mtfLhO1P5AE8yzogE+ILHyp0BqXt8vGIfzpDnCkN+GKl8gOOMPrR4NAcLO+Rshc5
+nLs7BGB4SEi126Y6mSfp85m0++1QhWMz9HzqJEHCWKVcZYdCdEONP9js04EUnK33
+KtlJIWzZTQKBwAT0pBpGwmZRp35Lpx2gBitZhcVxrg0NBnaO2fNyAGPvZD8SLQLH
+AdAiov/a23Uc/PDbWLL5Pp9gwzj+s5glrssVOXdE8aUscr1b5rARdNNL1/Tos6u8
+ZUZ3sNqGaZx7a8U4gyYboexWyo9EC1C+AdkGBm7+AkM4euFwC9N6xsa/t5zKK5d6
+76hc0m+8SxivYCBkgkrqlfeGuZCQxU+mVsC0it6U+va8ojUjLGkZ80OuCwBf4xZl
+3+acU7vx9o8/gQKBwB7BrhU6MWrsc+cr/1KQaXum9mNyckomi82RFYvb8Yrilcg3
+8FBy9XqNRKeBa9MLw1HZYpHbzsXsVF7u4eQMloDTLVNUC5L6dKAI1owoyTa24uH9
+0WWTg/a8mTZMe1jhgrew+AJq27NV6z4PswR9GenDmyshDDudz7rBsflZCQRoXUfW
+RelV7BHU6UPBsXn4ASF4xnRyM6WvcKy9coKZcUqqgm3fLM/9OizCCMJgfXHBrE+x
+7nBqst746qlEedSRrQKBwQCVYwwKCHNlZxl0/NMkDJ+hp7/InHF6mz/3VO58iCb1
+9TLDVUC2dDGPXNYwWTT9PclefwV5HNBHcAfTzgB4dpQyNiDyV914HL7DFEGduoPn
+wBYjeFre54v0YjjnskjJO7myircdbdX//i+7LMUw5aZZXCC8a5BD/rdV6IKJWJG5
+QBXbe5fVf1XwOjBTzlhIPIqhNFfSu+mFikp5BRwHGBqsKMju6inYmW6YADeY/SvO
+QjDEB37RqGZxqyIx8V2ZYwU=
+-----END PRIVATE KEY-----
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted.pub b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted.pub
new file mode 100644
index 00000000000..a3e04eed461
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/test_keys/rsa_pkcs8_unencrypted.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCn4+QiJojZ9mgc9KYJIvDWGaz4qFhf0CButg6L8zEoHKwuiN+mqcEciCCOa9BNiJmm8NTTehZvrrglGG59zIbqYtDAHjVn+vtb49xPzIv+M651Yqj08lIbR9tEIHKCq7aH8GlDm8NgG9EzJGjlL7okQym4TH1MHl+s4mUyr/qb2unlZBDixAQsphU8iCLftukWCIkmQg4CSj1Gh3WbBlZ+EX5eW0EXuAw4XsSbBTWV9CHRowVIpYqPvEYSpHsoCjEcd988p19hpiGknA0J4z7JfUlNgyT/1chb8GCTDT+2DCBRApbsIg6TOBVS+PR6emAQ3eZzUW0+3/oRM4ip0ujltQy8uU6gvYIAqx5wXGMThVpZcUgahKiSsVo/s4b84iMe4DG3W8jz4qi6yyNv0VedEzPUZ1lXd1GJFoy9uKNuSTe+1ksicAcluZN6LuNsPHcPxFCzOcmoNnVXEKAXInt+ys//5CDVasroZSAHZnDjUD4oNsLI3VIOnGxgXrkwSH0= testkey
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/unix.rs b/apps/desktop/desktop_native/core/src/ssh_agent/unix.rs
new file mode 100644
index 00000000000..c1a39506660
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/unix.rs
@@ -0,0 +1,77 @@
+use std::{
+    collections::HashMap,
+    sync::{Arc, RwLock},
+};
+
+use bitwarden_russh::ssh_agent;
+use homedir::my_home;
+use tokio::{net::UnixListener, sync::Mutex};
+use tokio_util::sync::CancellationToken;
+
+use super::BitwardenDesktopAgent;
+
+impl BitwardenDesktopAgent {
+    pub async fn start_server(
+        auth_request_tx: tokio::sync::mpsc::Sender<(u32, String)>,
+        auth_response_rx: Arc<Mutex<tokio::sync::broadcast::Receiver<(u32, bool)>>>,
+    ) -> Result<Self, anyhow::Error> {
+        use std::path::PathBuf;
+
+        let agent = BitwardenDesktopAgent {
+            keystore: ssh_agent::KeyStore(Arc::new(RwLock::new(HashMap::new()))),
+            cancellation_token: CancellationToken::new(),
+            show_ui_request_tx: auth_request_tx,
+            get_ui_response_rx: auth_response_rx,
+            request_id: Arc::new(tokio::sync::Mutex::new(0)),
+        };
+        let cloned_agent_state = agent.clone();
+        tokio::spawn(async move {
+            let ssh_path = match std::env::var("BITWARDEN_SSH_AUTH_SOCK") {
+                Ok(path) => path,
+                Err(_) => {
+                    println!("[SSH Agent Native Module] BITWARDEN_SSH_AUTH_SOCK not set, using default path");
+
+                    let ssh_agent_directory = match my_home() {
+                        Ok(Some(home)) => home,
+                        _ => PathBuf::from("/tmp/"),
+                    };
+                    ssh_agent_directory
+                        .join(".bitwarden-ssh-agent.sock")
+                        .to_str()
+                        .expect("Path should be valid")
+                        .to_owned()
+                }
+            };
+
+            println!(
+                "[SSH Agent Native Module] Starting SSH Agent server on {:?}",
+                ssh_path
+            );
+            let sockname = std::path::Path::new(&ssh_path);
+            let _ = std::fs::remove_file(sockname);
+            match UnixListener::bind(sockname) {
+                Ok(listener) => {
+                    let wrapper = tokio_stream::wrappers::UnixListenerStream::new(listener);
+                    let cloned_keystore = cloned_agent_state.keystore.clone();
+                    let cloned_cancellation_token = cloned_agent_state.cancellation_token.clone();
+                    let _ = ssh_agent::serve(
+                        wrapper,
+                        cloned_agent_state,
+                        cloned_keystore,
+                        cloned_cancellation_token,
+                    )
+                    .await;
+                    println!("[SSH Agent Native Module] SSH Agent server exited");
+                }
+                Err(e) => {
+                    eprintln!(
+                        "[SSH Agent Native Module] Error while starting agent server: {}",
+                        e
+                    );
+                }
+            }
+        });
+
+        Ok(agent)
+    }
+}
diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/windows.rs b/apps/desktop/desktop_native/core/src/ssh_agent/windows.rs
new file mode 100644
index 00000000000..fd6d9dacb9f
--- /dev/null
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/windows.rs
@@ -0,0 +1,41 @@
+use bitwarden_russh::ssh_agent;
+pub mod named_pipe_listener_stream;
+
+use std::{
+    collections::HashMap,
+    sync::{Arc, RwLock},
+};
+use tokio::sync::Mutex;
+use tokio_util::sync::CancellationToken;
+
+use super::BitwardenDesktopAgent;
+
+impl BitwardenDesktopAgent {
+    pub async fn start_server(
+        auth_request_tx: tokio::sync::mpsc::Sender<(u32, String)>,
+        auth_response_rx: Arc<Mutex<tokio::sync::broadcast::Receiver<(u32, bool)>>>,
+    ) -> Result<Self, anyhow::Error> {
+        let agent_state = BitwardenDesktopAgent {
+            keystore: ssh_agent::KeyStore(Arc::new(RwLock::new(HashMap::new()))),
+            show_ui_request_tx: auth_request_tx,
+            get_ui_response_rx: auth_response_rx,
+            cancellation_token: CancellationToken::new(),
+            request_id: Arc::new(tokio::sync::Mutex::new(0)),
+        };
+        let stream = named_pipe_listener_stream::NamedPipeServerStream::new(
+            agent_state.cancellation_token.clone(),
+        );
+
+        let cloned_agent_state = agent_state.clone();
+        tokio::spawn(async move {
+            let _ = ssh_agent::serve(
+                stream,
+                cloned_agent_state.clone(),
+                cloned_agent_state.keystore.clone(),
+                cloned_agent_state.cancellation_token.clone(),
+            )
+            .await;
+        });
+        Ok(agent_state)
+    }
+}
diff --git a/apps/desktop/desktop_native/napi/Cargo.toml b/apps/desktop/desktop_native/napi/Cargo.toml
index 942ccdba212..bef7a766c76 100644
--- a/apps/desktop/desktop_native/napi/Cargo.toml
+++ b/apps/desktop/desktop_native/napi/Cargo.toml
@@ -15,9 +15,13 @@ manual_test = []
 
 [dependencies]
 anyhow = "=1.0.86"
+base64 = "0.22.1"
 desktop_core = { path = "../core" }
+hex = "0.4.3"
 napi = { version = "=2.16.6", features = ["async"] }
 napi-derive = "=2.16.5"
+tokio = "1.39.1"
+tokio-stream = "0.1.15"
 
 [build-dependencies]
 napi-build = "=2.1.3"
diff --git a/apps/desktop/desktop_native/napi/index.d.ts b/apps/desktop/desktop_native/napi/index.d.ts
index dc3cc7ec0bb..c06b2dfc9fe 100644
--- a/apps/desktop/desktop_native/napi/index.d.ts
+++ b/apps/desktop/desktop_native/napi/index.d.ts
@@ -42,12 +42,46 @@ export namespace clipboards {
   export function read(): Promise<string>
   export function write(text: string, password: boolean): Promise<void>
 }
+export namespace sshagent {
+  export interface PrivateKey {
+    privateKey: string
+    name: string
+    cipherId: string
+  }
+  export interface SshKey {
+    privateKey: string
+    publicKey: string
+    keyFingerprint: string
+  }
+  export const enum SshKeyImportStatus {
+    /** ssh key was parsed correctly and will be returned in the result */
+    Success = 0,
+    /** ssh key was parsed correctly but is encrypted and requires a password */
+    PasswordRequired = 1,
+    /** ssh key was parsed correctly, and a password was provided when calling the import, but it was incorrect */
+    WrongPassword = 2,
+    /** ssh key could not be parsed, either due to an incorrect / unsupported format (pkcs#8) or key type (ecdsa), or because the input is not an ssh key */
+    ParsingError = 3,
+    /** ssh key type is not supported (e.g. ecdsa) */
+    UnsupportedKeyType = 4
+  }
+  export interface SshKeyImportResult {
+    status: SshKeyImportStatus
+    sshKey?: SshKey
+  }
+  export function serve(callback: (err: Error | null, arg: string) => any): Promise<SshAgentState>
+  export function stop(agentState: SshAgentState): void
+  export function setKeys(agentState: SshAgentState, newKeys: Array<PrivateKey>): void
+  export function lock(agentState: SshAgentState): void
+  export function importKey(encodedKey: string, password: string): SshKeyImportResult
+  export function generateKeypair(keyAlgorithm: string): Promise<SshKey>
+  export class SshAgentState {   }
+}
 export namespace processisolations {
   export function disableCoredumps(): Promise<void>
   export function isCoreDumpingDisabled(): Promise<boolean>
   export function disableMemoryAccess(): Promise<void>
 }
-
 export namespace powermonitors {
   export function onLock(callback: (err: Error | null, ) => any): Promise<void>
   export function isLockMonitorAvailable(): Promise<boolean>
diff --git a/apps/desktop/desktop_native/napi/index.js b/apps/desktop/desktop_native/napi/index.js
index 680f1302b9a..9beeebcb053 100644
--- a/apps/desktop/desktop_native/napi/index.js
+++ b/apps/desktop/desktop_native/napi/index.js
@@ -206,10 +206,11 @@ if (!nativeBinding) {
   throw new Error(`Failed to load native binding`)
 }
 
-const { passwords, biometrics, clipboards, processisolations, powermonitors } = nativeBinding
+const { passwords, biometrics, clipboards, processisolations, sshagent, powermonitors } = nativeBinding;
 
 module.exports.passwords = passwords
 module.exports.biometrics = biometrics
 module.exports.clipboards = clipboards
+module.exports.sshagent = sshagent
 module.exports.processisolations = processisolations
 module.exports.powermonitors = powermonitors
diff --git a/apps/desktop/desktop_native/napi/src/lib.rs b/apps/desktop/desktop_native/napi/src/lib.rs
index dfdc316d259..baf24fbaa6b 100644
--- a/apps/desktop/desktop_native/napi/src/lib.rs
+++ b/apps/desktop/desktop_native/napi/src/lib.rs
@@ -51,12 +51,16 @@ pub mod biometrics {
         hwnd: napi::bindgen_prelude::Buffer,
         message: String,
     ) -> napi::Result<bool> {
-        Biometric::prompt(hwnd.into(), message).await.map_err(|e| napi::Error::from_reason(e.to_string()))
+        Biometric::prompt(hwnd.into(), message)
+            .await
+            .map_err(|e| napi::Error::from_reason(e.to_string()))
     }
 
     #[napi]
     pub async fn available() -> napi::Result<bool> {
-        Biometric::available().await.map_err(|e| napi::Error::from_reason(e.to_string()))
+        Biometric::available()
+            .await
+            .map_err(|e| napi::Error::from_reason(e.to_string()))
     }
 
     #[napi]
@@ -148,6 +152,199 @@ pub mod clipboards {
     }
 }
 
+#[napi]
+pub mod sshagent {
+    use std::sync::Arc;
+
+    use napi::{
+        bindgen_prelude::Promise,
+        threadsafe_function::{ErrorStrategy::CalleeHandled, ThreadsafeFunction},
+    };
+    use tokio::{self, sync::Mutex};
+
+    #[napi]
+    pub struct SshAgentState {
+        state: desktop_core::ssh_agent::BitwardenDesktopAgent,
+    }
+
+    #[napi(object)]
+    pub struct PrivateKey {
+        pub private_key: String,
+        pub name: String,
+        pub cipher_id: String,
+    }
+
+    #[napi(object)]
+    pub struct SshKey {
+        pub private_key: String,
+        pub public_key: String,
+        pub key_fingerprint: String,
+    }
+
+    impl From<desktop_core::ssh_agent::importer::SshKey> for SshKey {
+        fn from(key: desktop_core::ssh_agent::importer::SshKey) -> Self {
+            SshKey {
+                private_key: key.private_key,
+                public_key: key.public_key,
+                key_fingerprint: key.key_fingerprint,
+            }
+        }
+    }
+
+    #[napi]
+    pub enum SshKeyImportStatus {
+        /// ssh key was parsed correctly and will be returned in the result
+        Success,
+        /// ssh key was parsed correctly but is encrypted and requires a password
+        PasswordRequired,
+        /// ssh key was parsed correctly, and a password was provided when calling the import, but it was incorrect
+        WrongPassword,
+        /// ssh key could not be parsed, either due to an incorrect / unsupported format (pkcs#8) or key type (ecdsa), or because the input is not an ssh key
+        ParsingError,
+        /// ssh key type is not supported (e.g. ecdsa)
+        UnsupportedKeyType,
+    }
+
+    impl From<desktop_core::ssh_agent::importer::SshKeyImportStatus> for SshKeyImportStatus {
+        fn from(status: desktop_core::ssh_agent::importer::SshKeyImportStatus) -> Self {
+            match status {
+                desktop_core::ssh_agent::importer::SshKeyImportStatus::Success => {
+                    SshKeyImportStatus::Success
+                }
+                desktop_core::ssh_agent::importer::SshKeyImportStatus::PasswordRequired => {
+                    SshKeyImportStatus::PasswordRequired
+                }
+                desktop_core::ssh_agent::importer::SshKeyImportStatus::WrongPassword => {
+                    SshKeyImportStatus::WrongPassword
+                }
+                desktop_core::ssh_agent::importer::SshKeyImportStatus::ParsingError => {
+                    SshKeyImportStatus::ParsingError
+                }
+                desktop_core::ssh_agent::importer::SshKeyImportStatus::UnsupportedKeyType => {
+                    SshKeyImportStatus::UnsupportedKeyType
+                }
+            }
+        }
+    }
+
+    #[napi(object)]
+    pub struct SshKeyImportResult {
+        pub status: SshKeyImportStatus,
+        pub ssh_key: Option<SshKey>,
+    }
+
+    impl From<desktop_core::ssh_agent::importer::SshKeyImportResult> for SshKeyImportResult {
+        fn from(result: desktop_core::ssh_agent::importer::SshKeyImportResult) -> Self {
+            SshKeyImportResult {
+                status: result.status.into(),
+                ssh_key: result.ssh_key.map(|k| k.into()),
+            }
+        }
+    }
+
+    #[napi]
+    pub async fn serve(
+        callback: ThreadsafeFunction<String, CalleeHandled>,
+    ) -> napi::Result<SshAgentState> {
+        let (auth_request_tx, mut auth_request_rx) = tokio::sync::mpsc::channel::<(u32, String)>(32);
+        let (auth_response_tx, auth_response_rx) = tokio::sync::broadcast::channel::<(u32, bool)>(32);
+        let auth_response_tx_arc = Arc::new(Mutex::new(auth_response_tx));
+        tokio::spawn(async move {
+            let _ = auth_response_rx;
+
+            while let Some((request_id, cipher_uuid)) = auth_request_rx.recv().await {
+                let cloned_request_id = request_id.clone();
+                let cloned_cipher_uuid = cipher_uuid.clone();
+                let cloned_response_tx_arc = auth_response_tx_arc.clone();
+                let cloned_callback = callback.clone();
+                tokio::spawn(async move {
+                    let request_id = cloned_request_id;
+                    let cipher_uuid = cloned_cipher_uuid;
+                    let auth_response_tx_arc = cloned_response_tx_arc;
+                    let callback = cloned_callback;
+                    let promise_result: Result<Promise<bool>, napi::Error> =
+                        callback.call_async(Ok(cipher_uuid)).await;
+                    match promise_result {
+                        Ok(promise_result) => match promise_result.await {
+                            Ok(result) => {
+                                let _ = auth_response_tx_arc.lock().await.send((request_id, result))
+                                    .expect("should be able to send auth response to agent");
+                            }
+                            Err(e) => {
+                                println!("[SSH Agent Native Module] calling UI callback promise was rejected: {}", e);
+                                let _ = auth_response_tx_arc.lock().await.send((request_id, false))
+                                    .expect("should be able to send auth response to agent");
+                            }
+                        },
+                        Err(e) => {
+                            println!("[SSH Agent Native Module] calling UI callback could not create promise: {}", e);
+                            let _ = auth_response_tx_arc.lock().await.send((request_id, false))
+                                .expect("should be able to send auth response to agent");
+                        }
+                    }
+                });
+            }
+        });
+
+        match desktop_core::ssh_agent::BitwardenDesktopAgent::start_server(
+            auth_request_tx,
+            Arc::new(Mutex::new(auth_response_rx)),
+        )
+        .await
+        {
+            Ok(state) => Ok(SshAgentState { state }),
+            Err(e) => Err(napi::Error::from_reason(e.to_string())),
+        }
+    }
+
+    #[napi]
+    pub fn stop(agent_state: &mut SshAgentState) -> napi::Result<()> {
+        let bitwarden_agent_state = &mut agent_state.state;
+        bitwarden_agent_state.stop();
+        Ok(())
+    }
+
+    #[napi]
+    pub fn set_keys(
+        agent_state: &mut SshAgentState,
+        new_keys: Vec<PrivateKey>,
+    ) -> napi::Result<()> {
+        let bitwarden_agent_state = &mut agent_state.state;
+        bitwarden_agent_state
+            .set_keys(
+                new_keys
+                    .iter()
+                    .map(|k| (k.private_key.clone(), k.name.clone(), k.cipher_id.clone()))
+                    .collect(),
+            )
+            .map_err(|e| napi::Error::from_reason(e.to_string()))?;
+        Ok(())
+    }
+
+    #[napi]
+    pub fn lock(agent_state: &mut SshAgentState) -> napi::Result<()> {
+        let bitwarden_agent_state = &mut agent_state.state;
+        bitwarden_agent_state
+            .lock()
+            .map_err(|e| napi::Error::from_reason(e.to_string()))
+    }
+
+    #[napi]
+    pub fn import_key(encoded_key: String, password: String) -> napi::Result<SshKeyImportResult> {
+        let result = desktop_core::ssh_agent::importer::import_key(encoded_key, password)
+            .map_err(|e| napi::Error::from_reason(e.to_string()))?;
+        Ok(result.into())
+    }
+
+    #[napi]
+    pub async fn generate_keypair(key_algorithm: String) -> napi::Result<SshKey> {
+        desktop_core::ssh_agent::generator::generate_keypair(key_algorithm)
+            .await
+            .map_err(|e| napi::Error::from_reason(e.to_string()))
+            .map(|k| k.into())
+    }
+}
+
 #[napi]
 pub mod processisolations {
     #[napi]
@@ -169,12 +366,19 @@ pub mod processisolations {
 
 #[napi]
 pub mod powermonitors {
-    use napi::{threadsafe_function::{ErrorStrategy::CalleeHandled, ThreadsafeFunction, ThreadsafeFunctionCallMode}, tokio};
+    use napi::{
+        threadsafe_function::{
+            ErrorStrategy::CalleeHandled, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+        },
+        tokio,
+    };
 
     #[napi]
     pub async fn on_lock(callback: ThreadsafeFunction<(), CalleeHandled>) -> napi::Result<()> {
         let (tx, mut rx) = tokio::sync::mpsc::channel::<()>(32);
-        desktop_core::powermonitor::on_lock(tx).await.map_err(|e| napi::Error::from_reason(e.to_string()))?;
+        desktop_core::powermonitor::on_lock(tx)
+            .await
+            .map_err(|e| napi::Error::from_reason(e.to_string()))?;
         tokio::spawn(async move {
             while let Some(message) = rx.recv().await {
                 callback.call(Ok(message.into()), ThreadsafeFunctionCallMode::NonBlocking);
@@ -187,5 +391,4 @@ pub mod powermonitors {
     pub async fn is_lock_monitor_available() -> napi::Result<bool> {
         Ok(desktop_core::powermonitor::is_lock_monitor_available().await)
     }
-
 }
diff --git a/apps/desktop/src/app/accounts/settings.component.html b/apps/desktop/src/app/accounts/settings.component.html
index 359d856525e..a520c4569e0 100644
--- a/apps/desktop/src/app/accounts/settings.component.html
+++ b/apps/desktop/src/app/accounts/settings.component.html
@@ -419,6 +419,23 @@ <h2>
                   "enableHardwareAccelerationDesc" | i18n
                 }}</small>
               </div>
+              <div class="form-group">
+                <div class="checkbox">
+                  <label for="enableSshAgent">
+                    <input
+                      id="enableSshAgent"
+                      type="checkbox"
+                      aria-describedby="enableSshAgentHelp"
+                      formControlName="enableSshAgent"
+                      (change)="saveSshAgent()"
+                    />
+                    {{ "enableSshAgent" | i18n }}
+                  </label>
+                </div>
+                <small id="enableSshAgentHelp" class="help-block">{{
+                  "enableSshAgentDesc" | i18n
+                }}</small>
+              </div>
               <div class="form-group" *ngIf="showDuckDuckGoIntegrationOption">
                 <div class="checkbox">
                   <label for="enableDuckDuckGoBrowserIntegration">
diff --git a/apps/desktop/src/app/accounts/settings.component.ts b/apps/desktop/src/app/accounts/settings.component.ts
index d85447398a4..7a429bf49af 100644
--- a/apps/desktop/src/app/accounts/settings.component.ts
+++ b/apps/desktop/src/app/accounts/settings.component.ts
@@ -108,6 +108,7 @@ export class SettingsComponent implements OnInit, OnDestroy {
       disabled: true,
     }),
     enableHardwareAcceleration: true,
+    enableSshAgent: false,
     enableDuckDuckGoBrowserIntegration: false,
     theme: [null as ThemeType | null],
     locale: [null as string | null],
@@ -275,6 +276,7 @@ export class SettingsComponent implements OnInit, OnDestroy {
       enableHardwareAcceleration: await firstValueFrom(
         this.desktopSettingsService.hardwareAcceleration$,
       ),
+      enableSshAgent: await firstValueFrom(this.desktopSettingsService.sshAgentEnabled$),
       theme: await firstValueFrom(this.themeStateService.selectedTheme$),
       locale: await firstValueFrom(this.i18nService.userSetLocale$),
     };
@@ -726,6 +728,11 @@ export class SettingsComponent implements OnInit, OnDestroy {
     );
   }
 
+  async saveSshAgent() {
+    this.logService.debug("Saving Ssh Agent settings", this.form.value.enableSshAgent);
+    await this.desktopSettingsService.setSshAgentEnabled(this.form.value.enableSshAgent);
+  }
+
   private async generateVaultTimeoutOptions(): Promise<VaultTimeoutOption[]> {
     let vaultTimeoutOptions: VaultTimeoutOption[] = [
       { name: this.i18nService.t("oneMinute"), value: 1 },
diff --git a/apps/desktop/src/app/app.module.ts b/apps/desktop/src/app/app.module.ts
index c4861b96608..d787234e8b3 100644
--- a/apps/desktop/src/app/app.module.ts
+++ b/apps/desktop/src/app/app.module.ts
@@ -22,6 +22,7 @@ import { SsoComponent } from "../auth/sso.component";
 import { TwoFactorOptionsComponent } from "../auth/two-factor-options.component";
 import { TwoFactorComponent } from "../auth/two-factor.component";
 import { UpdateTempPasswordComponent } from "../auth/update-temp-password.component";
+import { SshAgentService } from "../platform/services/ssh-agent.service";
 import { PremiumComponent } from "../vault/app/accounts/premium.component";
 import { AddEditCustomFieldsComponent } from "../vault/app/vault/add-edit-custom-fields.component";
 import { AddEditComponent } from "../vault/app/vault/add-edit.component";
@@ -100,6 +101,7 @@ import { SendComponent } from "./tools/send/send.component";
     ViewComponent,
     ViewCustomFieldsComponent,
   ],
+  providers: [SshAgentService],
   bootstrap: [AppComponent],
 })
 export class AppModule {}
diff --git a/apps/desktop/src/app/services/init.service.ts b/apps/desktop/src/app/services/init.service.ts
index 8793587300f..52e95d3bbf1 100644
--- a/apps/desktop/src/app/services/init.service.ts
+++ b/apps/desktop/src/app/services/init.service.ts
@@ -21,6 +21,7 @@ import { VaultTimeoutService } from "@bitwarden/common/services/vault-timeout/va
 import { UserId } from "@bitwarden/common/types/guid";
 
 import { I18nRendererService } from "../../platform/services/i18n.renderer.service";
+import { SshAgentService } from "../../platform/services/ssh-agent.service";
 import { NativeMessagingService } from "../../services/native-messaging.service";
 
 @Injectable()
@@ -41,11 +42,13 @@ export class InitService {
     private encryptService: EncryptService,
     private userAutoUnlockKeyService: UserAutoUnlockKeyService,
     private accountService: AccountService,
+    private sshAgentService: SshAgentService,
     @Inject(DOCUMENT) private document: Document,
   ) {}
 
   init() {
     return async () => {
+      this.sshAgentService.init();
       this.nativeMessagingService.init();
       await this.stateService.init({ runMigrations: false }); // Desktop will run them in main process
 
diff --git a/apps/desktop/src/locales/en/messages.json b/apps/desktop/src/locales/en/messages.json
index 27e6a668ce9..ad5b752a2cc 100644
--- a/apps/desktop/src/locales/en/messages.json
+++ b/apps/desktop/src/locales/en/messages.json
@@ -26,7 +26,7 @@
   "typeSecureNote": {
     "message": "Secure note"
   },
-  "typeSSHKey": {
+  "typeSshKey": {
     "message": "SSH key"
   },
   "folders": {
@@ -201,6 +201,24 @@
   "sshKeyAlgorithmRSA4096": {
     "message": "RSA 4096-Bit"
   },
+  "sshKeyGenerated": {
+    "message": "A new SSH key was generated"
+  },
+  "sshAgentUnlockRequired": {
+    "message": "Please unlock your vault to approve the Ssh key request."
+  },
+  "sshAgentUnlockTimeout": {
+    "message": "SSH key request timed out."
+  },
+  "enableSshAgent": {
+    "message": "Enable SSH agent"
+  },
+  "enableSshAgentDesc": {
+    "message": "Enable the SSH agent to sign Ssh requests right from your Bitwarden vault."
+  },
+  "enableSshAgentHelp": {
+    "message": "The Ssh agent is a service targeted at developers that allows you to sign Ssh requests directly from your Bitwarden vault."
+  },
   "premiumRequired": {
     "message": "Premium required"
   },
@@ -421,6 +439,12 @@
   "copyPassword": {
     "message": "Copy password"
   },
+  "regenerateSshKey": {
+    "message": "Regenerate Ssh key"
+  },
+  "copySshPrivateKey": {
+    "message": "Copy Ssh private key"
+  },
   "copyUri": {
     "message": "Copy URI"
   },
@@ -765,10 +789,10 @@
   "selfHostedBaseUrlHint": {
     "message": "Specify the base URL of your on-premises hosted Bitwarden installation. Example: https://bitwarden.company.com"
   },
-  "selfHostedCustomEnvHeader" :{
+  "selfHostedCustomEnvHeader": {
     "message": "For advanced configuration, you can specify the base URL of each service independently."
   },
-  "selfHostedEnvFormInvalid" :{
+  "selfHostedEnvFormInvalid": {
     "message": "You must add either the base Server URL or at least one custom environment."
   },
   "customEnvironment": {
@@ -1306,10 +1330,10 @@
       }
     }
   },
-  "errorRefreshingAccessToken":{
+  "errorRefreshingAccessToken": {
     "message": "Access Token Refresh Error"
   },
-  "errorRefreshingAccessTokenDesc":{
+  "errorRefreshingAccessTokenDesc": {
     "message": "No refresh token or API keys found. Please try logging out and logging back in."
   },
   "help": {
@@ -1695,7 +1719,7 @@
     "message": "Your organization requires you to set a master password.",
     "description": "Used as a card title description on the set password page to explain why the user is there"
   },
-  "verificationRequired" : {
+  "verificationRequired": {
     "message": "Verification required",
     "description": "Default title for the user verification dialog."
   },
@@ -3079,5 +3103,35 @@
   },
   "textSends": {
     "message": "Text Sends"
+  },
+  "ssoError": {
+    "message": "No free ports could be found for the sso login."
+  },
+  "authorize": {
+    "message": "Authorize"
+  },
+  "deny": {
+    "message": "Deny"
+  },
+  "sshkeyApprovalTitle": {
+    "message": "Confirm SSH key usage"
+  },
+  "sshkeyApprovalMessageInfix": {
+    "message": "is requesting access to"
+  },
+  "unknownApplication": {
+    "message": "An application"
+  },
+  "sshKeyPasswordUnsupported": {
+    "message": "Importing password protected SSH keys is not yet supported"
+  },
+  "invalidSshKey": {
+    "message": "The SSH key is invalid"
+  },
+  "importSshKeyFromClipboard": {
+    "message": "Import key from clipboard"
+  },
+  "sshKeyPasted": {
+    "message": "SSH key imported successfully"
   }
 }
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
index 816d317f411..2e6994a656d 100644
--- a/apps/desktop/src/main.ts
+++ b/apps/desktop/src/main.ts
@@ -36,6 +36,7 @@ import { BiometricsService, BiometricsServiceAbstraction } from "./platform/main
 import { ClipboardMain } from "./platform/main/clipboard.main";
 import { DesktopCredentialStorageListener } from "./platform/main/desktop-credential-storage-listener";
 import { MainCryptoFunctionService } from "./platform/main/main-crypto-function.service";
+import { MainSshAgentService } from "./platform/main/main-ssh-agent.service";
 import { DesktopSettingsService } from "./platform/services/desktop-settings.service";
 import { ElectronLogMainService } from "./platform/services/electron-log.main.service";
 import { ElectronStorageService } from "./platform/services/electron-storage.service";
@@ -226,6 +227,9 @@ export class Main {
     this.clipboardMain = new ClipboardMain();
     this.clipboardMain.init();
 
+    const sshAgent = new MainSshAgentService(this.logService, this.messagingService);
+    sshAgent.init();
+
     new EphemeralValueStorageService();
   }
 
diff --git a/apps/desktop/src/main/window.main.ts b/apps/desktop/src/main/window.main.ts
index deb370201ff..b56ab92d10a 100644
--- a/apps/desktop/src/main/window.main.ts
+++ b/apps/desktop/src/main/window.main.ts
@@ -67,6 +67,19 @@ export class WindowMain {
       this.session.clearCache();
     });
 
+    ipcMain.on("window-focus", () => {
+      if (this.win != null) {
+        this.win.show();
+        this.win.focus();
+      }
+    });
+
+    ipcMain.on("window-hide", () => {
+      if (this.win != null) {
+        this.win.hide();
+      }
+    });
+
     return new Promise<void>((resolve, reject) => {
       try {
         if (!isMacAppStore() && !isSnapStore()) {
diff --git a/apps/desktop/src/platform/components/approve-ssh-request.html b/apps/desktop/src/platform/components/approve-ssh-request.html
new file mode 100644
index 00000000000..eac451a1fbe
--- /dev/null
+++ b/apps/desktop/src/platform/components/approve-ssh-request.html
@@ -0,0 +1,17 @@
+<form [bitSubmit]="submit" [formGroup]="approveSshRequestForm">
+  <bit-dialog>
+    <div class="tw-font-semibold" bitDialogTitle>{{ "sshkeyApprovalTitle" | i18n }}</div>
+    <div bitDialogContent>
+      <b>{{params.applicationName}}</b> {{ "sshkeyApprovalMessageInfix" | i18n }}
+      <b>{{params.cipherName}}</b>.
+    </div>
+    <div bitDialogFooter>
+      <button type="submit" bitButton bitFormButton buttonType="primary">
+        <span>{{ "authorize" | i18n }}</span>
+      </button>
+      <button type="button" bitButton bitFormButton buttonType="secondary" bitDialogClose>
+        {{ "deny" | i18n }}
+      </button>
+    </div>
+  </bit-dialog>
+</form>
diff --git a/apps/desktop/src/platform/components/approve-ssh-request.ts b/apps/desktop/src/platform/components/approve-ssh-request.ts
new file mode 100644
index 00000000000..62200962dca
--- /dev/null
+++ b/apps/desktop/src/platform/components/approve-ssh-request.ts
@@ -0,0 +1,59 @@
+import { DIALOG_DATA, DialogRef } from "@angular/cdk/dialog";
+import { CommonModule } from "@angular/common";
+import { Component, Inject } from "@angular/core";
+import { FormBuilder, ReactiveFormsModule } from "@angular/forms";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import {
+  AsyncActionsModule,
+  ButtonModule,
+  DialogModule,
+  FormFieldModule,
+  IconButtonModule,
+} from "@bitwarden/components";
+import { DialogService } from "@bitwarden/components/src/dialog";
+import { CipherFormGeneratorComponent } from "@bitwarden/vault";
+
+export interface ApproveSshRequestParams {
+  cipherName: string;
+  applicationName: string;
+}
+
+@Component({
+  selector: "app-approve-ssh-request",
+  templateUrl: "approve-ssh-request.html",
+  standalone: true,
+  imports: [
+    DialogModule,
+    CommonModule,
+    JslibModule,
+    CipherFormGeneratorComponent,
+    ButtonModule,
+    IconButtonModule,
+    ReactiveFormsModule,
+    AsyncActionsModule,
+    FormFieldModule,
+  ],
+})
+export class ApproveSshRequestComponent {
+  approveSshRequestForm = this.formBuilder.group({});
+
+  constructor(
+    @Inject(DIALOG_DATA) protected params: ApproveSshRequestParams,
+    private dialogRef: DialogRef<boolean>,
+    private formBuilder: FormBuilder,
+  ) {}
+
+  static open(dialogService: DialogService, cipherName: string, applicationName: string) {
+    return dialogService.open<boolean, ApproveSshRequestParams>(ApproveSshRequestComponent, {
+      data: {
+        cipherName,
+        applicationName,
+      },
+    });
+  }
+
+  submit = async () => {
+    this.dialogRef.close(true);
+  };
+}
diff --git a/apps/desktop/src/platform/main/main-ssh-agent.service.ts b/apps/desktop/src/platform/main/main-ssh-agent.service.ts
new file mode 100644
index 00000000000..c8227e5b6a5
--- /dev/null
+++ b/apps/desktop/src/platform/main/main-ssh-agent.service.ts
@@ -0,0 +1,115 @@
+import { ipcMain } from "electron";
+import { concatMap, delay, filter, firstValueFrom, from, race, take, timer } from "rxjs";
+
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
+import { sshagent } from "@bitwarden/desktop-napi";
+
+class AgentResponse {
+  requestId: number;
+  accepted: boolean;
+  timestamp: Date;
+}
+
+export class MainSshAgentService {
+  SIGN_TIMEOUT = 60_000;
+  REQUEST_POLL_INTERVAL = 50;
+
+  private requestResponses: AgentResponse[] = [];
+  private request_id = 0;
+  private agentState: sshagent.SshAgentState;
+
+  constructor(
+    private logService: LogService,
+    private messagingService: MessagingService,
+  ) {}
+
+  init() {
+    // handle sign request passing to UI
+    sshagent
+      .serve(async (err: Error, cipherId: string) => {
+        // clear all old (> SIGN_TIMEOUT) requests
+        this.requestResponses = this.requestResponses.filter(
+          (response) => response.timestamp > new Date(Date.now() - this.SIGN_TIMEOUT),
+        );
+
+        this.request_id += 1;
+        const id_for_this_request = this.request_id;
+        this.messagingService.send("sshagent.signrequest", {
+          cipherId,
+          requestId: id_for_this_request,
+        });
+
+        const result = await firstValueFrom(
+          race(
+            from([false]).pipe(delay(this.SIGN_TIMEOUT)),
+
+            //poll for response
+            timer(0, this.REQUEST_POLL_INTERVAL).pipe(
+              concatMap(() => from(this.requestResponses)),
+              filter((response) => response.requestId == id_for_this_request),
+              take(1),
+              concatMap(() => from([true])),
+            ),
+          ),
+        );
+
+        if (!result) {
+          return false;
+        }
+
+        const response = this.requestResponses.find(
+          (response) => response.requestId == id_for_this_request,
+        );
+
+        this.requestResponses = this.requestResponses.filter(
+          (response) => response.requestId != id_for_this_request,
+        );
+
+        return response.accepted;
+      })
+      .then((agentState: sshagent.SshAgentState) => {
+        this.agentState = agentState;
+        this.logService.info("SSH agent started");
+      })
+      .catch((e) => {
+        this.logService.error("SSH agent encountered an error: ", e);
+      });
+
+    ipcMain.handle(
+      "sshagent.setkeys",
+      async (event: any, keys: { name: string; privateKey: string; cipherId: string }[]) => {
+        if (this.agentState != null) {
+          sshagent.setKeys(this.agentState, keys);
+        }
+      },
+    );
+    ipcMain.handle(
+      "sshagent.signrequestresponse",
+      async (event: any, { requestId, accepted }: { requestId: number; accepted: boolean }) => {
+        this.requestResponses.push({ requestId, accepted, timestamp: new Date() });
+      },
+    );
+    ipcMain.handle(
+      "sshagent.generatekey",
+      async (event: any, { keyAlgorithm }: { keyAlgorithm: string }): Promise<sshagent.SshKey> => {
+        return await sshagent.generateKeypair(keyAlgorithm);
+      },
+    );
+    ipcMain.handle(
+      "sshagent.importkey",
+      async (
+        event: any,
+        { privateKey, password }: { privateKey: string; password?: string },
+      ): Promise<sshagent.SshKeyImportResult> => {
+        return sshagent.importKey(privateKey, password);
+      },
+    );
+
+    ipcMain.handle("sshagent.lock", async (event: any) => {
+      if (this.agentState != null) {
+        sshagent.lock(this.agentState);
+      }
+    });
+  }
+}
diff --git a/apps/desktop/src/platform/preload.ts b/apps/desktop/src/platform/preload.ts
index 163ef9ae22c..b8da3bb0b2d 100644
--- a/apps/desktop/src/platform/preload.ts
+++ b/apps/desktop/src/platform/preload.ts
@@ -1,3 +1,4 @@
+import { sshagent as ssh } from "desktop_native/napi";
 import { ipcRenderer } from "electron";
 
 import { DeviceType } from "@bitwarden/common/enums";
@@ -71,6 +72,27 @@ const clipboard = {
   write: (message: ClipboardWriteMessage) => ipcRenderer.invoke("clipboard.write", message),
 };
 
+const sshAgent = {
+  setKeys: (keys: { name: string; privateKey: string; cipherId: string }[]): Promise<void> =>
+    ipcRenderer.invoke("sshagent.setkeys", keys),
+  signRequestResponse: async (requestId: number, accepted: boolean) => {
+    await ipcRenderer.invoke("sshagent.signrequestresponse", { requestId, accepted });
+  },
+  generateKey: async (keyAlgorithm: string): Promise<ssh.SshKey> => {
+    return await ipcRenderer.invoke("sshagent.generatekey", { keyAlgorithm });
+  },
+  lock: async () => {
+    return await ipcRenderer.invoke("sshagent.lock");
+  },
+  importKey: async (key: string, password: string): Promise<ssh.SshKeyImportResult> => {
+    const res = await ipcRenderer.invoke("sshagent.importkey", {
+      privateKey: key,
+      password: password,
+    });
+    return res;
+  },
+};
+
 const powermonitor = {
   isLockMonitorAvailable: (): Promise<boolean> =>
     ipcRenderer.invoke("powermonitor.isLockMonitorAvailable"),
@@ -130,6 +152,8 @@ export default {
   isFlatpak: isFlatpak(),
   isSnapStore: isSnapStore(),
   reloadProcess: () => ipcRenderer.send("reload-process"),
+  focusWindow: () => ipcRenderer.send("window-focus"),
+  hideWindow: () => ipcRenderer.send("window-hide"),
   log: (level: LogLevelType, message?: any, ...optionalParams: any[]) =>
     ipcRenderer.invoke("ipc.log", { level, message, optionalParams }),
 
@@ -175,6 +199,7 @@ export default {
   passwords,
   biometric,
   clipboard,
+  sshAgent,
   powermonitor,
   nativeMessaging,
   crypto,
diff --git a/apps/desktop/src/platform/services/desktop-settings.service.ts b/apps/desktop/src/platform/services/desktop-settings.service.ts
index ff29ce50a0f..c698e7d5b1b 100644
--- a/apps/desktop/src/platform/services/desktop-settings.service.ts
+++ b/apps/desktop/src/platform/services/desktop-settings.service.ts
@@ -66,6 +66,10 @@ const BROWSER_INTEGRATION_FINGERPRINT_ENABLED = new KeyDefinition<boolean>(
   },
 );
 
+const SSH_AGENT_ENABLED = new KeyDefinition<boolean>(DESKTOP_SETTINGS_DISK, "sshAgentEnabled", {
+  deserializer: (b) => b,
+});
+
 const MINIMIZE_ON_COPY = new UserKeyDefinition<boolean>(DESKTOP_SETTINGS_DISK, "minimizeOnCopy", {
   deserializer: (b) => b,
   clearOn: [], // User setting, no need to clear
@@ -139,6 +143,10 @@ export class DesktopSettingsService {
   browserIntegrationFingerprintEnabled$ =
     this.browserIntegrationFingerprintEnabledState.state$.pipe(map(Boolean));
 
+  private readonly sshAgentEnabledState = this.stateProvider.getGlobal(SSH_AGENT_ENABLED);
+
+  sshAgentEnabled$ = this.sshAgentEnabledState.state$.pipe(map(Boolean));
+
   private readonly minimizeOnCopyState = this.stateProvider.getActive(MINIMIZE_ON_COPY);
 
   /**
@@ -246,6 +254,13 @@ export class DesktopSettingsService {
     await this.browserIntegrationFingerprintEnabledState.update(() => value);
   }
 
+  /**
+   * Sets a setting for whether or not the SSH agent is enabled.
+   */
+  async setSshAgentEnabled(value: boolean) {
+    await this.sshAgentEnabledState.update(() => value);
+  }
+
   /**
    * Sets the minimize on copy value for the current user.
    * @param value `true` if the application should minimize when a value is copied,
diff --git a/apps/desktop/src/platform/services/ssh-agent.service.ts b/apps/desktop/src/platform/services/ssh-agent.service.ts
new file mode 100644
index 00000000000..49a25d3b106
--- /dev/null
+++ b/apps/desktop/src/platform/services/ssh-agent.service.ts
@@ -0,0 +1,175 @@
+import { Injectable, OnDestroy } from "@angular/core";
+import {
+  catchError,
+  combineLatest,
+  concatMap,
+  EMPTY,
+  filter,
+  from,
+  map,
+  of,
+  Subject,
+  switchMap,
+  takeUntil,
+  timeout,
+  TimeoutError,
+  timer,
+  withLatestFrom,
+} from "rxjs";
+
+import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
+import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { CommandDefinition, MessageListener } from "@bitwarden/common/platform/messaging";
+import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
+import { CipherType } from "@bitwarden/common/vault/enums";
+import { DialogService, ToastService } from "@bitwarden/components";
+
+import { ApproveSshRequestComponent } from "../components/approve-ssh-request";
+
+import { DesktopSettingsService } from "./desktop-settings.service";
+
+@Injectable({
+  providedIn: "root",
+})
+export class SshAgentService implements OnDestroy {
+  SSH_REFRESH_INTERVAL = 1000;
+  SSH_VAULT_UNLOCK_REQUEST_TIMEOUT = 1000 * 60;
+  SSH_REQUEST_UNLOCK_POLLING_INTERVAL = 100;
+
+  private destroy$ = new Subject<void>();
+
+  constructor(
+    private cipherService: CipherService,
+    private logService: LogService,
+    private dialogService: DialogService,
+    private messageListener: MessageListener,
+    private authService: AuthService,
+    private toastService: ToastService,
+    private i18nService: I18nService,
+    private desktopSettingsService: DesktopSettingsService,
+  ) {}
+
+  init() {
+    this.messageListener
+      .messages$(new CommandDefinition("sshagent.signrequest"))
+      .pipe(
+        withLatestFrom(this.authService.activeAccountStatus$),
+        // This switchMap handles unlocking the vault if it is locked:
+        //   - If the vault is locked, we will wait for it to be unlocked.
+        //   - If the vault is not unlocked within the timeout, we will abort the flow.
+        //   - If the vault is unlocked, we will continue with the flow.
+        // switchMap is used here to prevent multiple requests from being processed at the same time,
+        // and will cancel the previous request if a new one is received.
+        switchMap(([message, status]) => {
+          if (status !== AuthenticationStatus.Unlocked) {
+            ipc.platform.focusWindow();
+            this.toastService.showToast({
+              variant: "info",
+              title: null,
+              message: this.i18nService.t("sshAgentUnlockRequired"),
+            });
+            return this.authService.activeAccountStatus$.pipe(
+              filter((status) => status === AuthenticationStatus.Unlocked),
+              timeout(this.SSH_VAULT_UNLOCK_REQUEST_TIMEOUT),
+              catchError((error: unknown) => {
+                if (error instanceof TimeoutError) {
+                  this.toastService.showToast({
+                    variant: "error",
+                    title: null,
+                    message: this.i18nService.t("sshAgentUnlockTimeout"),
+                  });
+                  const requestId = message.requestId as number;
+                  // Abort flow by sending a false response.
+                  // Returning an empty observable this will prevent the rest of the flow from executing
+                  return from(ipc.platform.sshAgent.signRequestResponse(requestId, false)).pipe(
+                    map(() => EMPTY),
+                  );
+                }
+
+                throw error;
+              }),
+              map(() => message),
+            );
+          }
+
+          return of(message);
+        }),
+        // This switchMap handles fetching the ciphers from the vault.
+        switchMap((message) =>
+          from(this.cipherService.getAllDecrypted()).pipe(
+            map((ciphers) => [message, ciphers] as const),
+          ),
+        ),
+        // This concatMap handles showing the dialog to approve the request.
+        concatMap(([message, decryptedCiphers]) => {
+          const cipherId = message.cipherId as string;
+          const requestId = message.requestId as number;
+
+          if (decryptedCiphers === undefined) {
+            return of(false).pipe(
+              switchMap((result) =>
+                ipc.platform.sshAgent.signRequestResponse(requestId, Boolean(result)),
+              ),
+            );
+          }
+
+          const cipher = decryptedCiphers.find((cipher) => cipher.id == cipherId);
+
+          ipc.platform.focusWindow();
+          const dialogRef = ApproveSshRequestComponent.open(
+            this.dialogService,
+            cipher.name,
+            this.i18nService.t("unknownApplication"),
+          );
+
+          return dialogRef.closed.pipe(
+            switchMap((result) => {
+              return ipc.platform.sshAgent.signRequestResponse(requestId, Boolean(result));
+            }),
+          );
+        }),
+        takeUntil(this.destroy$),
+      )
+      .subscribe();
+
+    combineLatest([
+      timer(0, this.SSH_REFRESH_INTERVAL),
+      this.desktopSettingsService.sshAgentEnabled$,
+    ])
+      .pipe(
+        concatMap(async ([, enabled]) => {
+          if (!enabled) {
+            await ipc.platform.sshAgent.setKeys([]);
+            return;
+          }
+
+          const ciphers = await this.cipherService.getAllDecrypted();
+          if (ciphers == null) {
+            await ipc.platform.sshAgent.lock();
+            return;
+          }
+
+          const sshCiphers = ciphers.filter(
+            (cipher) => cipher.type === CipherType.SshKey && !cipher.isDeleted,
+          );
+          const keys = sshCiphers.map((cipher) => {
+            return {
+              name: cipher.name,
+              privateKey: cipher.sshKey.privateKey,
+              cipherId: cipher.id,
+            };
+          });
+          await ipc.platform.sshAgent.setKeys(keys);
+        }),
+        takeUntil(this.destroy$),
+      )
+      .subscribe();
+  }
+
+  ngOnDestroy() {
+    this.destroy$.next();
+    this.destroy$.complete();
+  }
+}
diff --git a/apps/desktop/src/vault/app/vault/add-edit.component.html b/apps/desktop/src/vault/app/vault/add-edit.component.html
index 64e15243bf0..df561267d9d 100644
--- a/apps/desktop/src/vault/app/vault/add-edit.component.html
+++ b/apps/desktop/src/vault/app/vault/add-edit.component.html
@@ -11,7 +11,7 @@ <h2 class="box-header">
         <div class="box-content">
           <div class="box-content-row" *ngIf="!editMode" appBoxRow>
             <label for="type">{{ "type" | i18n }}</label>
-            <select id="type" name="Type" [(ngModel)]="cipher.type">
+            <select id="type" name="Type" [(ngModel)]="cipher.type" (change)="typeChange()">
               <option *ngFor="let o of typeOptions" [ngValue]="o.value">{{ o.name }}</option>
             </select>
           </div>
@@ -471,8 +471,8 @@ <h2 class="box-header">
               />
             </div>
           </div>
-          <!-- SSH Key -->
-          <div *ngIf="cipher.type === cipherType.SSHKey">
+          <!-- Ssh Key -->
+          <div *ngIf="cipher.type === cipherType.SshKey">
             <div class="box-content-row box-content-row-flex" appBoxRow>
               <div class="row-main">
                 <label for="sshPrivateKey">{{ "sshPrivateKey" | i18n }}</label>
@@ -490,6 +490,15 @@ <h2 class="box-header">
                 ></div>
               </div>
               <div class="action-buttons">
+                <button
+                  type="button"
+                  class="row-btn"
+                  appStopClick
+                  appA11yTitle="{{ 'copySshPrivateKey' | i18n }}"
+                  (click)="copy(this.cipher.sshKey.privateKey, 'sshPrivateKey', 'SshPrivateKey')"
+                >
+                  <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+                </button>
                 <button
                   type="button"
                   class="row-btn"
@@ -507,9 +516,11 @@ <h2 class="box-header">
                   type="button"
                   class="row-btn"
                   appStopClick
-                  (click)="copy(this.cipher.sshKey.privateKey, 'sshPrivateKey', 'SSHPrivateKey')"
+                  appA11yTitle="{{ 'regenerateSshKey' | i18n }}"
+                  (click)="generateSshKey()"
+                  *ngIf="cipher.edit || !editMode"
                 >
-                  <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
+                  <i class="bwi bwi-lg bwi-generate" aria-hidden="true"></i>
                 </button>
               </div>
             </div>
@@ -558,6 +569,16 @@ <h2 class="box-header">
                 </button>
               </div>
             </div>
+            <div class="box-content-row box-content-row-flex" appBoxRow>
+              <button
+                type="button"
+                class="row-btn"
+                appStopClick
+                (click)="importSshKeyFromClipboard()"
+              >
+                {{ "importSshKeyFromClipboard" | i18n }}
+              </button>
+            </div>
           </div>
         </div>
       </div>
diff --git a/apps/desktop/src/vault/app/vault/add-edit.component.ts b/apps/desktop/src/vault/app/vault/add-edit.component.ts
index 87355ab930d..255f9167304 100644
--- a/apps/desktop/src/vault/app/vault/add-edit.component.ts
+++ b/apps/desktop/src/vault/app/vault/add-edit.component.ts
@@ -1,6 +1,7 @@
 import { DatePipe } from "@angular/common";
-import { Component, NgZone, OnChanges, OnInit, OnDestroy, ViewChild } from "@angular/core";
+import { Component, NgZone, OnChanges, OnDestroy, OnInit, ViewChild } from "@angular/core";
 import { NgForm } from "@angular/forms";
+import { sshagent as sshAgent } from "desktop_native/napi";
 
 import { AddEditComponent as BaseAddEditComponent } from "@bitwarden/angular/vault/components/add-edit.component";
 import { AuditService } from "@bitwarden/common/abstractions/audit.service";
@@ -18,7 +19,8 @@ import { SendApiService } from "@bitwarden/common/tools/send/services/send-api.s
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CollectionService } from "@bitwarden/common/vault/abstractions/collection.service";
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
-import { DialogService } from "@bitwarden/components";
+import { CipherType } from "@bitwarden/common/vault/enums";
+import { DialogService, ToastService } from "@bitwarden/components";
 import { PasswordRepromptService } from "@bitwarden/vault";
 
 const BroadcasterSubscriptionId = "AddEditComponent";
@@ -51,6 +53,7 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On
     dialogService: DialogService,
     datePipe: DatePipe,
     configService: ConfigService,
+    private toastService: ToastService,
   ) {
     super(
       cipherService,
@@ -139,6 +142,60 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On
     );
   }
 
+  async generateSshKey() {
+    const sshKey = await ipc.platform.sshAgent.generateKey("ed25519");
+    this.cipher.sshKey.privateKey = sshKey.privateKey;
+    this.cipher.sshKey.publicKey = sshKey.publicKey;
+    this.cipher.sshKey.keyFingerprint = sshKey.keyFingerprint;
+    this.toastService.showToast({
+      variant: "success",
+      title: "",
+      message: this.i18nService.t("sshKeyGenerated"),
+    });
+  }
+
+  async importSshKeyFromClipboard() {
+    const key = await this.platformUtilsService.readFromClipboard();
+    const parsedKey = await ipc.platform.sshAgent.importKey(key, "");
+    if (parsedKey == null || parsedKey.status == sshAgent.SshKeyImportStatus.ParsingError) {
+      this.toastService.showToast({
+        variant: "error",
+        title: "",
+        message: this.i18nService.t("invalidSshKey"),
+      });
+      return;
+    } else if (
+      parsedKey.status == sshAgent.SshKeyImportStatus.PasswordRequired ||
+      parsedKey.status == sshAgent.SshKeyImportStatus.WrongPassword
+    ) {
+      this.toastService.showToast({
+        variant: "error",
+        title: "",
+        message: this.i18nService.t("sshKeyPasswordUnsupported"),
+      });
+      return;
+    } else {
+      this.cipher.sshKey.privateKey = parsedKey.sshKey.privateKey;
+      this.cipher.sshKey.publicKey = parsedKey.sshKey.publicKey;
+      this.cipher.sshKey.keyFingerprint = parsedKey.sshKey.keyFingerprint;
+      this.toastService.showToast({
+        variant: "success",
+        title: "",
+        message: this.i18nService.t("sshKeyPasted"),
+      });
+    }
+  }
+
+  async typeChange() {
+    if (this.cipher.type == CipherType.SshKey) {
+      await this.generateSshKey();
+    }
+  }
+
+  truncateString(value: string, length: number) {
+    return value.length > length ? value.substring(0, length) + "..." : value;
+  }
+
   togglePrivateKey() {
     this.showPrivateKey = !this.showPrivateKey;
   }
diff --git a/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html b/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html
index 55ae80eb593..c3dcd191dfc 100644
--- a/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html
+++ b/apps/desktop/src/vault/app/vault/vault-filter/filters/type-filter.component.html
@@ -81,16 +81,16 @@ <h2>
   </li>
   <li
     class="filter-option"
-    [ngClass]="{ active: activeFilter.cipherType === cipherTypeEnum.SSHKey }"
+    [ngClass]="{ active: activeFilter.cipherType === cipherTypeEnum.SshKey }"
   >
     <span class="filter-buttons">
       <button
         type="button"
         class="filter-button"
-        (click)="applyFilter(cipherTypeEnum.SSHKey)"
-        [attr.aria-pressed]="activeFilter.cipherType === cipherTypeEnum.SSHKey"
+        (click)="applyFilter(cipherTypeEnum.SshKey)"
+        [attr.aria-pressed]="activeFilter.cipherType === cipherTypeEnum.SshKey"
       >
-        <i class="bwi bwi-fw bwi-key" aria-hidden="true"></i>&nbsp;{{ "typeSSHKey" | i18n }}
+        <i class="bwi bwi-fw bwi-key" aria-hidden="true"></i>&nbsp;{{ "typeSshKey" | i18n }}
       </button>
     </span>
   </li>
diff --git a/apps/desktop/src/vault/app/vault/view.component.html b/apps/desktop/src/vault/app/vault/view.component.html
index 0512d0af544..6f0422959b3 100644
--- a/apps/desktop/src/vault/app/vault/view.component.html
+++ b/apps/desktop/src/vault/app/vault/view.component.html
@@ -399,7 +399,7 @@ <h2 class="box-header">
             <div *ngIf="cipher.identity.country">{{ cipher.identity.country }}</div>
           </div>
         </div>
-        <!-- SSH Key -->
+        <!-- Ssh Key -->
         <div *ngIf="cipher.sshKey">
           <div class="box-content-row box-content-row-flex" *ngIf="cipher.sshKey.privateKey">
             <div class="row-main">
@@ -453,7 +453,7 @@ <h2 class="box-header">
               <input
                 id="sshPublicKey"
                 type="text"
-                name="SSHKey.SSHPublicKey"
+                name="SshKey.SshPublicKey"
                 [ngModel]="cipher.sshKey.publicKey"
                 readonly
               />
@@ -463,8 +463,8 @@ <h2 class="box-header">
                 type="button"
                 class="row-btn"
                 appStopClick
-                (click)="copy(cipher.sshKey.publicKey, 'sshPublicKey', 'SSHPublicKey')"
-                appA11yTitle="{{ 'generateSSHKey' | i18n }}"
+                (click)="copy(cipher.sshKey.publicKey, 'sshPublicKey', 'SshPublicKey')"
+                appA11yTitle="{{ 'generateSshKey' | i18n }}"
               >
                 <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
               </button>
@@ -480,7 +480,7 @@ <h2 class="box-header">
               <input
                 id="sshKeyFingerprint"
                 type="text"
-                name="SSHKey.SSHKeyFingerprint"
+                name="SshKey.SshKeyFingerprint"
                 [ngModel]="cipher.sshKey.keyFingerprint"
                 readonly
               />
@@ -490,8 +490,8 @@ <h2 class="box-header">
                 type="button"
                 class="row-btn"
                 appStopClick
-                (click)="copy(cipher.sshKey.keyFingerprint, 'sshFingerprint', 'SSHFingerprint')"
-                appA11yTitle="{{ 'generateSSHKey' | i18n }}"
+                (click)="copy(cipher.sshKey.keyFingerprint, 'sshFingerprint', 'SshFingerprint')"
+                appA11yTitle="{{ 'generateSshKey' | i18n }}"
               >
                 <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
               </button>
diff --git a/apps/web/src/app/vault/individual-vault/add-edit.component.html b/apps/web/src/app/vault/individual-vault/add-edit.component.html
index d5f47cabfb1..455679ad5fb 100644
--- a/apps/web/src/app/vault/individual-vault/add-edit.component.html
+++ b/apps/web/src/app/vault/individual-vault/add-edit.component.html
@@ -847,8 +847,8 @@ <h1 class="modal-title" id="cipherAddEditTitle">{{ title }}</h1>
             </div>
           </div>
         </ng-container>
-        <!-- SSH Key -->
-        <ng-container *ngIf="cipher.type === cipherType.SSHKey">
+        <!-- Ssh Key -->
+        <ng-container *ngIf="cipher.type === cipherType.SshKey">
           <div class="row">
             <div class="col-12 form-group">
               <label for="sshKeyPrivateKey">{{ "sshKeyPrivateKey" | i18n }}</label>
@@ -895,7 +895,7 @@ <h1 class="modal-title" id="cipherAddEditTitle">{{ title }}</h1>
                   id="sshKeyPublicKey"
                   class="form-control"
                   type="text"
-                  name="SSHKey.PublicKey"
+                  name="SshKey.PublicKey"
                   [(ngModel)]="cipher.sshKey.publicKey"
                   appInputVerbatim
                   disabled
@@ -905,7 +905,7 @@ <h1 class="modal-title" id="cipherAddEditTitle">{{ title }}</h1>
                   <button
                     type="button"
                     class="btn btn-outline-secondary"
-                    appA11yTitle="{{ 'copySSHPublicKey' | i18n }}"
+                    appA11yTitle="{{ 'copySshPublicKey' | i18n }}"
                     (click)="copy(cipher.sshKey.publicKey, 'sshKeyPublicKey', 'PublicKey')"
                   >
                     <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
@@ -920,7 +920,7 @@ <h1 class="modal-title" id="cipherAddEditTitle">{{ title }}</h1>
                   id="sshKeyFingerprint"
                   class="form-control"
                   type="text"
-                  name="SSHKey.Fingerprint"
+                  name="SshKey.Fingerprint"
                   [(ngModel)]="cipher.sshKey.keyFingerprint"
                   appInputVerbatim
                   disabled
@@ -930,7 +930,7 @@ <h1 class="modal-title" id="cipherAddEditTitle">{{ title }}</h1>
                   <button
                     type="button"
                     class="btn btn-outline-secondary"
-                    appA11yTitle="{{ 'copySSHFingerprint' | i18n }}"
+                    appA11yTitle="{{ 'copySshFingerprint' | i18n }}"
                     (click)="copy(cipher.sshKey.keyFingerprint, 'sshKeyFingerprint', 'Fingerprint')"
                   >
                     <i class="bwi bwi-lg bwi-clone" aria-hidden="true"></i>
diff --git a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
index afb6a0a4988..92b9034fa35 100644
--- a/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
+++ b/apps/web/src/app/vault/individual-vault/vault-filter/components/vault-filter.component.ts
@@ -218,8 +218,8 @@ export class VaultFilterComponent implements OnInit, OnDestroy {
       },
       {
         id: "sshKey",
-        name: this.i18nService.t("typeSSHKey"),
-        type: CipherType.SSHKey,
+        name: this.i18nService.t("typeSshKey"),
+        type: CipherType.SshKey,
         icon: "bwi-key",
       },
     ];
diff --git a/apps/web/src/locales/en/messages.json b/apps/web/src/locales/en/messages.json
index df55b27ccf7..cb74090652d 100644
--- a/apps/web/src/locales/en/messages.json
+++ b/apps/web/src/locales/en/messages.json
@@ -403,8 +403,8 @@
   "typeSecureNote": {
     "message": "Secure note"
   },
-  "typeSSHKey": {
-    "message": "SSH key"
+  "typeSshKey": {
+    "message": "Ssh key"
   },
   "typeLoginPlural": {
     "message": "Logins"
diff --git a/libs/angular/src/vault/components/add-edit.component.ts b/libs/angular/src/vault/components/add-edit.component.ts
index f5490f2d5df..5344e687cb9 100644
--- a/libs/angular/src/vault/components/add-edit.component.ts
+++ b/libs/angular/src/vault/components/add-edit.component.ts
@@ -12,7 +12,7 @@ import { PolicyService } from "@bitwarden/common/admin-console/abstractions/poli
 import { OrganizationUserStatusType, PolicyType } from "@bitwarden/common/admin-console/enums";
 import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { EventType } from "@bitwarden/common/enums";
+import { ClientType, EventType } from "@bitwarden/common/enums";
 import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { UriMatchStrategy } from "@bitwarden/common/models/domain/domain-service";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
@@ -37,7 +37,7 @@ import { IdentityView } from "@bitwarden/common/vault/models/view/identity.view"
 import { LoginUriView } from "@bitwarden/common/vault/models/view/login-uri.view";
 import { LoginView } from "@bitwarden/common/vault/models/view/login.view";
 import { SecureNoteView } from "@bitwarden/common/vault/models/view/secure-note.view";
-import { SSHKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
+import { SshKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
 import { DialogService } from "@bitwarden/components";
 import { PasswordRepromptService } from "@bitwarden/vault";
 
@@ -201,6 +201,11 @@ export class AddEditComponent implements OnInit, OnDestroy {
 
     this.writeableCollections = await this.loadCollections();
     this.canUseReprompt = await this.passwordRepromptService.enabled();
+
+    const sshKeysEnabled = await this.configService.getFeatureFlag(FeatureFlag.SSHKeyVaultItem);
+    if (this.platformUtilsService.getClientType() == ClientType.Desktop && sshKeysEnabled) {
+      this.typeOptions.push({ name: this.i18nService.t("typeSshKey"), value: CipherType.SshKey });
+    }
   }
 
   ngOnDestroy() {
@@ -280,7 +285,7 @@ export class AddEditComponent implements OnInit, OnDestroy {
         this.cipher.identity = new IdentityView();
         this.cipher.secureNote = new SecureNoteView();
         this.cipher.secureNote.type = SecureNoteType.Generic;
-        this.cipher.sshKey = new SSHKeyView();
+        this.cipher.sshKey = new SshKeyView();
         this.cipher.reprompt = CipherRepromptType.None;
       }
     }
diff --git a/libs/common/src/enums/feature-flag.enum.ts b/libs/common/src/enums/feature-flag.enum.ts
index 583b6996970..04dd781bc28 100644
--- a/libs/common/src/enums/feature-flag.enum.ts
+++ b/libs/common/src/enums/feature-flag.enum.ts
@@ -33,12 +33,14 @@ export enum FeatureFlag {
   GenerateIdentityFillScriptRefactor = "generate-identity-fill-script-refactor",
   DelayFido2PageScriptInitWithinMv2 = "delay-fido2-page-script-init-within-mv2",
   AccountDeprovisioning = "pm-10308-account-deprovisioning",
+  SSHKeyVaultItem = "ssh-key-vault-item",
 }
 
 export type AllowedFeatureFlagTypes = boolean | number | string;
 
 // Helper to ensure the value is treated as a boolean.
 const FALSE = false as boolean;
+const TRUE = true as boolean;
 
 /**
  * Default value for feature flags.
@@ -76,6 +78,7 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.GenerateIdentityFillScriptRefactor]: FALSE,
   [FeatureFlag.DelayFido2PageScriptInitWithinMv2]: FALSE,
   [FeatureFlag.AccountDeprovisioning]: FALSE,
+  [FeatureFlag.SSHKeyVaultItem]: TRUE,
 } satisfies Record<FeatureFlag, AllowedFeatureFlagTypes>;
 
 export type DefaultFeatureFlagValueType = typeof DefaultFeatureFlagValue;
diff --git a/libs/common/src/models/export/cipher.export.ts b/libs/common/src/models/export/cipher.export.ts
index b5654f38b52..432a2d4e250 100644
--- a/libs/common/src/models/export/cipher.export.ts
+++ b/libs/common/src/models/export/cipher.export.ts
@@ -10,7 +10,7 @@ import { IdentityExport } from "./identity.export";
 import { LoginExport } from "./login.export";
 import { PasswordHistoryExport } from "./password-history.export";
 import { SecureNoteExport } from "./secure-note.export";
-import { SSHKeyExport } from "./ssh-key.export";
+import { SshKeyExport } from "./ssh-key.export";
 import { safeGetString } from "./utils";
 
 export class CipherExport {
@@ -69,8 +69,8 @@ export class CipherExport {
       case CipherType.Identity:
         view.identity = IdentityExport.toView(req.identity);
         break;
-      case CipherType.SSHKey:
-        view.sshKey = SSHKeyExport.toView(req.sshKey);
+      case CipherType.SshKey:
+        view.sshKey = SshKeyExport.toView(req.sshKey);
     }
 
     if (req.passwordHistory != null) {
@@ -112,8 +112,8 @@ export class CipherExport {
       case CipherType.Identity:
         domain.identity = IdentityExport.toDomain(req.identity);
         break;
-      case CipherType.SSHKey:
-        domain.sshKey = SSHKeyExport.toDomain(req.sshKey);
+      case CipherType.SshKey:
+        domain.sshKey = SshKeyExport.toDomain(req.sshKey);
         break;
     }
 
@@ -139,7 +139,7 @@ export class CipherExport {
   secureNote: SecureNoteExport;
   card: CardExport;
   identity: IdentityExport;
-  sshKey: SSHKeyExport;
+  sshKey: SshKeyExport;
   reprompt: CipherRepromptType;
   passwordHistory: PasswordHistoryExport[] = null;
   revisionDate: Date = null;
@@ -179,8 +179,8 @@ export class CipherExport {
       case CipherType.Identity:
         this.identity = new IdentityExport(o.identity);
         break;
-      case CipherType.SSHKey:
-        this.sshKey = new SSHKeyExport(o.sshKey);
+      case CipherType.SshKey:
+        this.sshKey = new SshKeyExport(o.sshKey);
         break;
     }
 
diff --git a/libs/common/src/models/export/ssh-key.export.ts b/libs/common/src/models/export/ssh-key.export.ts
index 63183d74344..86683e97e20 100644
--- a/libs/common/src/models/export/ssh-key.export.ts
+++ b/libs/common/src/models/export/ssh-key.export.ts
@@ -1,27 +1,27 @@
-import { SSHKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
+import { SshKeyView as SshKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
 
 import { EncString } from "../../platform/models/domain/enc-string";
-import { SSHKey as SSHKeyDomain } from "../../vault/models/domain/ssh-key";
+import { SshKey as SshKeyDomain } from "../../vault/models/domain/ssh-key";
 
 import { safeGetString } from "./utils";
 
-export class SSHKeyExport {
-  static template(): SSHKeyExport {
-    const req = new SSHKeyExport();
+export class SshKeyExport {
+  static template(): SshKeyExport {
+    const req = new SshKeyExport();
     req.privateKey = "";
     req.publicKey = "";
     req.keyFingerprint = "";
     return req;
   }
 
-  static toView(req: SSHKeyExport, view = new SSHKeyView()) {
+  static toView(req: SshKeyExport, view = new SshKeyView()) {
     view.privateKey = req.privateKey;
     view.publicKey = req.publicKey;
     view.keyFingerprint = req.keyFingerprint;
     return view;
   }
 
-  static toDomain(req: SSHKeyExport, domain = new SSHKeyDomain()) {
+  static toDomain(req: SshKeyExport, domain = new SshKeyDomain()) {
     domain.privateKey = req.privateKey != null ? new EncString(req.privateKey) : null;
     domain.publicKey = req.publicKey != null ? new EncString(req.publicKey) : null;
     domain.keyFingerprint = req.keyFingerprint != null ? new EncString(req.keyFingerprint) : null;
@@ -32,7 +32,7 @@ export class SSHKeyExport {
   publicKey: string;
   keyFingerprint: string;
 
-  constructor(o?: SSHKeyView | SSHKeyDomain) {
+  constructor(o?: SshKeyView | SshKeyDomain) {
     if (o == null) {
       return;
     }
diff --git a/libs/common/src/vault/enums/cipher-type.ts b/libs/common/src/vault/enums/cipher-type.ts
index fab3e98dc6f..0b7bbf1ee17 100644
--- a/libs/common/src/vault/enums/cipher-type.ts
+++ b/libs/common/src/vault/enums/cipher-type.ts
@@ -3,5 +3,5 @@ export enum CipherType {
   SecureNote = 2,
   Card = 3,
   Identity = 4,
-  SSHKey = 5,
+  SshKey = 5,
 }
diff --git a/libs/common/src/vault/icon/build-cipher-icon.ts b/libs/common/src/vault/icon/build-cipher-icon.ts
index 29ba401c837..78e6ecd7b4f 100644
--- a/libs/common/src/vault/icon/build-cipher-icon.ts
+++ b/libs/common/src/vault/icon/build-cipher-icon.ts
@@ -67,7 +67,7 @@ export function buildCipherIcon(iconsServerUrl: string, cipher: CipherView, show
     case CipherType.Identity:
       icon = "bwi-id-card";
       break;
-    case CipherType.SSHKey:
+    case CipherType.SshKey:
       icon = "bwi-key";
       break;
     default:
diff --git a/libs/common/src/vault/models/api/ssh-key.api.ts b/libs/common/src/vault/models/api/ssh-key.api.ts
index e248408424f..e14f72bbc6a 100644
--- a/libs/common/src/vault/models/api/ssh-key.api.ts
+++ b/libs/common/src/vault/models/api/ssh-key.api.ts
@@ -1,6 +1,6 @@
 import { BaseResponse } from "../../../models/response/base.response";
 
-export class SSHKeyApi extends BaseResponse {
+export class SshKeyApi extends BaseResponse {
   privateKey: string;
   publicKey: string;
   keyFingerprint: string;
diff --git a/libs/common/src/vault/models/data/cipher.data.ts b/libs/common/src/vault/models/data/cipher.data.ts
index 22bb3e8be84..476c651f3ae 100644
--- a/libs/common/src/vault/models/data/cipher.data.ts
+++ b/libs/common/src/vault/models/data/cipher.data.ts
@@ -11,7 +11,7 @@ import { IdentityData } from "./identity.data";
 import { LoginData } from "./login.data";
 import { PasswordHistoryData } from "./password-history.data";
 import { SecureNoteData } from "./secure-note.data";
-import { SSHKeyData } from "./ssh-key.data";
+import { SshKeyData } from "./ssh-key.data";
 
 export class CipherData {
   id: string;
@@ -29,7 +29,7 @@ export class CipherData {
   secureNote?: SecureNoteData;
   card?: CardData;
   identity?: IdentityData;
-  sshKey?: SSHKeyData;
+  sshKey?: SshKeyData;
   fields?: FieldData[];
   attachments?: AttachmentData[];
   passwordHistory?: PasswordHistoryData[];
@@ -74,8 +74,8 @@ export class CipherData {
       case CipherType.Identity:
         this.identity = new IdentityData(response.identity);
         break;
-      case CipherType.SSHKey:
-        this.sshKey = new SSHKeyData(response.sshKey);
+      case CipherType.SshKey:
+        this.sshKey = new SshKeyData(response.sshKey);
         break;
       default:
         break;
diff --git a/libs/common/src/vault/models/data/ssh-key.data.ts b/libs/common/src/vault/models/data/ssh-key.data.ts
index 50eefd98dea..32b6ec994f3 100644
--- a/libs/common/src/vault/models/data/ssh-key.data.ts
+++ b/libs/common/src/vault/models/data/ssh-key.data.ts
@@ -1,11 +1,11 @@
-import { SSHKeyApi } from "../api/ssh-key.api";
+import { SshKeyApi } from "../api/ssh-key.api";
 
-export class SSHKeyData {
+export class SshKeyData {
   privateKey: string;
   publicKey: string;
   keyFingerprint: string;
 
-  constructor(data?: SSHKeyApi) {
+  constructor(data?: SshKeyApi) {
     if (data == null) {
       return;
     }
diff --git a/libs/common/src/vault/models/domain/cipher.ts b/libs/common/src/vault/models/domain/cipher.ts
index 3b22394abf0..79536f5379a 100644
--- a/libs/common/src/vault/models/domain/cipher.ts
+++ b/libs/common/src/vault/models/domain/cipher.ts
@@ -19,7 +19,7 @@ import { Identity } from "./identity";
 import { Login } from "./login";
 import { Password } from "./password";
 import { SecureNote } from "./secure-note";
-import { SSHKey } from "./ssh-key";
+import { SshKey } from "./ssh-key";
 
 export class Cipher extends Domain implements Decryptable<CipherView> {
   readonly initializerKey = InitializerKey.Cipher;
@@ -40,7 +40,7 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
   identity: Identity;
   card: Card;
   secureNote: SecureNote;
-  sshKey: SSHKey;
+  sshKey: SshKey;
   attachments: Attachment[];
   fields: Field[];
   passwordHistory: Password[];
@@ -99,8 +99,8 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.Identity:
         this.identity = new Identity(obj.identity);
         break;
-      case CipherType.SSHKey:
-        this.sshKey = new SSHKey(obj.sshKey);
+      case CipherType.SshKey:
+        this.sshKey = new SshKey(obj.sshKey);
         break;
       default:
         break;
@@ -161,7 +161,7 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.Identity:
         model.identity = await this.identity.decrypt(this.organizationId, encKey);
         break;
-      case CipherType.SSHKey:
+      case CipherType.SshKey:
         model.sshKey = await this.sshKey.decrypt(this.organizationId, encKey);
         break;
       default:
@@ -248,8 +248,8 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.Identity:
         c.identity = this.identity.toIdentityData();
         break;
-      case CipherType.SSHKey:
-        c.sshKey = this.sshKey.toSSHKeyData();
+      case CipherType.SshKey:
+        c.sshKey = this.sshKey.toSshKeyData();
         break;
       default:
         break;
@@ -306,8 +306,8 @@ export class Cipher extends Domain implements Decryptable<CipherView> {
       case CipherType.SecureNote:
         domain.secureNote = SecureNote.fromJSON(obj.secureNote);
         break;
-      case CipherType.SSHKey:
-        domain.sshKey = SSHKey.fromJSON(obj.sshKey);
+      case CipherType.SshKey:
+        domain.sshKey = SshKey.fromJSON(obj.sshKey);
         break;
       default:
         break;
diff --git a/libs/common/src/vault/models/domain/ssh-key.spec.ts b/libs/common/src/vault/models/domain/ssh-key.spec.ts
index 32ae2701928..f56d738fde8 100644
--- a/libs/common/src/vault/models/domain/ssh-key.spec.ts
+++ b/libs/common/src/vault/models/domain/ssh-key.spec.ts
@@ -1,15 +1,15 @@
 import { mockEnc } from "../../../../spec";
-import { SSHKeyApi } from "../api/ssh-key.api";
-import { SSHKeyData } from "../data/ssh-key.data";
+import { SshKeyApi } from "../api/ssh-key.api";
+import { SshKeyData } from "../data/ssh-key.data";
 
-import { SSHKey } from "./ssh-key";
+import { SshKey } from "./ssh-key";
 
-describe("SSHkey", () => {
-  let data: SSHKeyData;
+describe("Sshkey", () => {
+  let data: SshKeyData;
 
   beforeEach(() => {
-    data = new SSHKeyData(
-      new SSHKeyApi({
+    data = new SshKeyData(
+      new SshKeyApi({
         PrivateKey: "privateKey",
         PublicKey: "publicKey",
         KeyFingerprint: "keyFingerprint",
@@ -18,7 +18,7 @@ describe("SSHkey", () => {
   });
 
   it("Convert", () => {
-    const sshKey = new SSHKey(data);
+    const sshKey = new SshKey(data);
 
     expect(sshKey).toEqual({
       privateKey: { encryptedString: "privateKey", encryptionType: 0 },
@@ -28,8 +28,8 @@ describe("SSHkey", () => {
   });
 
   it("Convert from empty", () => {
-    const data = new SSHKeyData();
-    const sshKey = new SSHKey(data);
+    const data = new SshKeyData();
+    const sshKey = new SshKey(data);
 
     expect(sshKey).toEqual({
       privateKey: null,
@@ -38,13 +38,13 @@ describe("SSHkey", () => {
     });
   });
 
-  it("toSSHKeyData", () => {
-    const sshKey = new SSHKey(data);
-    expect(sshKey.toSSHKeyData()).toEqual(data);
+  it("toSshKeyData", () => {
+    const sshKey = new SshKey(data);
+    expect(sshKey.toSshKeyData()).toEqual(data);
   });
 
   it("Decrypt", async () => {
-    const sshKey = Object.assign(new SSHKey(), {
+    const sshKey = Object.assign(new SshKey(), {
       privateKey: mockEnc("privateKey"),
       publicKey: mockEnc("publicKey"),
       keyFingerprint: mockEnc("keyFingerprint"),
@@ -61,7 +61,7 @@ describe("SSHkey", () => {
 
   describe("fromJSON", () => {
     it("returns null if object is null", () => {
-      expect(SSHKey.fromJSON(null)).toBeNull();
+      expect(SshKey.fromJSON(null)).toBeNull();
     });
   });
 });
diff --git a/libs/common/src/vault/models/domain/ssh-key.ts b/libs/common/src/vault/models/domain/ssh-key.ts
index 6c893008ecc..e7c24b45ba8 100644
--- a/libs/common/src/vault/models/domain/ssh-key.ts
+++ b/libs/common/src/vault/models/domain/ssh-key.ts
@@ -4,15 +4,15 @@ import { EncString } from "@bitwarden/common/platform/models/domain/enc-string";
 
 import Domain from "../../../platform/models/domain/domain-base";
 import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key";
-import { SSHKeyData } from "../data/ssh-key.data";
-import { SSHKeyView } from "../view/ssh-key.view";
+import { SshKeyData } from "../data/ssh-key.data";
+import { SshKeyView } from "../view/ssh-key.view";
 
-export class SSHKey extends Domain {
+export class SshKey extends Domain {
   privateKey: EncString;
   publicKey: EncString;
   keyFingerprint: EncString;
 
-  constructor(obj?: SSHKeyData) {
+  constructor(obj?: SshKeyData) {
     super();
     if (obj == null) {
       return;
@@ -30,9 +30,9 @@ export class SSHKey extends Domain {
     );
   }
 
-  decrypt(orgId: string, encKey?: SymmetricCryptoKey): Promise<SSHKeyView> {
+  decrypt(orgId: string, encKey?: SymmetricCryptoKey): Promise<SshKeyView> {
     return this.decryptObj(
-      new SSHKeyView(),
+      new SshKeyView(),
       {
         privateKey: null,
         publicKey: null,
@@ -43,8 +43,8 @@ export class SSHKey extends Domain {
     );
   }
 
-  toSSHKeyData(): SSHKeyData {
-    const c = new SSHKeyData();
+  toSshKeyData(): SshKeyData {
+    const c = new SshKeyData();
     this.buildDataModel(this, c, {
       privateKey: null,
       publicKey: null,
@@ -53,7 +53,7 @@ export class SSHKey extends Domain {
     return c;
   }
 
-  static fromJSON(obj: Partial<Jsonify<SSHKey>>): SSHKey {
+  static fromJSON(obj: Partial<Jsonify<SshKey>>): SshKey {
     if (obj == null) {
       return null;
     }
@@ -61,7 +61,7 @@ export class SSHKey extends Domain {
     const privateKey = EncString.fromJSON(obj.privateKey);
     const publicKey = EncString.fromJSON(obj.publicKey);
     const keyFingerprint = EncString.fromJSON(obj.keyFingerprint);
-    return Object.assign(new SSHKey(), obj, {
+    return Object.assign(new SshKey(), obj, {
       privateKey,
       publicKey,
       keyFingerprint,
diff --git a/libs/common/src/vault/models/request/cipher.request.ts b/libs/common/src/vault/models/request/cipher.request.ts
index 532df558c6b..f24254f7432 100644
--- a/libs/common/src/vault/models/request/cipher.request.ts
+++ b/libs/common/src/vault/models/request/cipher.request.ts
@@ -7,7 +7,7 @@ import { IdentityApi } from "../api/identity.api";
 import { LoginUriApi } from "../api/login-uri.api";
 import { LoginApi } from "../api/login.api";
 import { SecureNoteApi } from "../api/secure-note.api";
-import { SSHKeyApi } from "../api/ssh-key.api";
+import { SshKeyApi } from "../api/ssh-key.api";
 import { Cipher } from "../domain/cipher";
 
 import { AttachmentRequest } from "./attachment.request";
@@ -24,7 +24,7 @@ export class CipherRequest {
   secureNote: SecureNoteApi;
   card: CardApi;
   identity: IdentityApi;
-  sshKey: SSHKeyApi;
+  sshKey: SshKeyApi;
   fields: FieldApi[];
   passwordHistory: PasswordHistoryRequest[];
   // Deprecated, remove at some point and rename attachments2 to attachments
@@ -95,8 +95,8 @@ export class CipherRequest {
         this.secureNote = new SecureNoteApi();
         this.secureNote.type = cipher.secureNote.type;
         break;
-      case CipherType.SSHKey:
-        this.sshKey = new SSHKeyApi();
+      case CipherType.SshKey:
+        this.sshKey = new SshKeyApi();
         this.sshKey.privateKey =
           cipher.sshKey.privateKey != null ? cipher.sshKey.privateKey.encryptedString : null;
         this.sshKey.publicKey =
diff --git a/libs/common/src/vault/models/response/cipher.response.ts b/libs/common/src/vault/models/response/cipher.response.ts
index 20b0d5d272f..7e2805b7510 100644
--- a/libs/common/src/vault/models/response/cipher.response.ts
+++ b/libs/common/src/vault/models/response/cipher.response.ts
@@ -5,7 +5,7 @@ import { FieldApi } from "../api/field.api";
 import { IdentityApi } from "../api/identity.api";
 import { LoginApi } from "../api/login.api";
 import { SecureNoteApi } from "../api/secure-note.api";
-import { SSHKeyApi } from "../api/ssh-key.api";
+import { SshKeyApi } from "../api/ssh-key.api";
 
 import { AttachmentResponse } from "./attachment.response";
 import { PasswordHistoryResponse } from "./password-history.response";
@@ -22,7 +22,7 @@ export class CipherResponse extends BaseResponse {
   card: CardApi;
   identity: IdentityApi;
   secureNote: SecureNoteApi;
-  sshKey: SSHKeyApi;
+  sshKey: SshKeyApi;
   favorite: boolean;
   edit: boolean;
   viewPassword: boolean;
@@ -79,7 +79,7 @@ export class CipherResponse extends BaseResponse {
 
     const sshKey = this.getResponseProperty("sshKey");
     if (sshKey != null) {
-      this.sshKey = new SSHKeyApi(sshKey);
+      this.sshKey = new SshKeyApi(sshKey);
     }
 
     const fields = this.getResponseProperty("Fields");
diff --git a/libs/common/src/vault/models/view/cipher.view.ts b/libs/common/src/vault/models/view/cipher.view.ts
index 3ab5b29f580..e2ffe2c0be9 100644
--- a/libs/common/src/vault/models/view/cipher.view.ts
+++ b/libs/common/src/vault/models/view/cipher.view.ts
@@ -15,7 +15,7 @@ import { IdentityView } from "./identity.view";
 import { LoginView } from "./login.view";
 import { PasswordHistoryView } from "./password-history.view";
 import { SecureNoteView } from "./secure-note.view";
-import { SSHKeyView } from "./ssh-key.view";
+import { SshKeyView } from "./ssh-key.view";
 
 export class CipherView implements View, InitializerMetadata {
   readonly initializerKey = InitializerKey.CipherView;
@@ -35,7 +35,7 @@ export class CipherView implements View, InitializerMetadata {
   identity = new IdentityView();
   card = new CardView();
   secureNote = new SecureNoteView();
-  sshKey = new SSHKeyView();
+  sshKey = new SshKeyView();
   attachments: AttachmentView[] = null;
   fields: FieldView[] = null;
   passwordHistory: PasswordHistoryView[] = null;
@@ -77,7 +77,7 @@ export class CipherView implements View, InitializerMetadata {
         return this.card;
       case CipherType.Identity:
         return this.identity;
-      case CipherType.SSHKey:
+      case CipherType.SshKey:
         return this.sshKey;
       default:
         break;
@@ -188,8 +188,8 @@ export class CipherView implements View, InitializerMetadata {
       case CipherType.SecureNote:
         view.secureNote = SecureNoteView.fromJSON(obj.secureNote);
         break;
-      case CipherType.SSHKey:
-        view.sshKey = SSHKeyView.fromJSON(obj.sshKey);
+      case CipherType.SshKey:
+        view.sshKey = SshKeyView.fromJSON(obj.sshKey);
         break;
       default:
         break;
diff --git a/libs/common/src/vault/models/view/ssh-key.view.ts b/libs/common/src/vault/models/view/ssh-key.view.ts
index 7a40972573a..4fedb1f8a36 100644
--- a/libs/common/src/vault/models/view/ssh-key.view.ts
+++ b/libs/common/src/vault/models/view/ssh-key.view.ts
@@ -1,15 +1,15 @@
 import { Jsonify } from "type-fest";
 
-import { SSHKey } from "../domain/ssh-key";
+import { SshKey } from "../domain/ssh-key";
 
 import { ItemView } from "./item.view";
 
-export class SSHKeyView extends ItemView {
+export class SshKeyView extends ItemView {
   privateKey: string = null;
   publicKey: string = null;
   keyFingerprint: string = null;
 
-  constructor(n?: SSHKey) {
+  constructor(n?: SshKey) {
     super();
     if (!n) {
       return;
@@ -35,7 +35,7 @@ export class SSHKeyView extends ItemView {
     return this.keyFingerprint;
   }
 
-  static fromJSON(obj: Partial<Jsonify<SSHKeyView>>): SSHKeyView {
-    return Object.assign(new SSHKeyView(), obj);
+  static fromJSON(obj: Partial<Jsonify<SshKeyView>>): SshKeyView {
+    return Object.assign(new SshKeyView(), obj);
   }
 }
diff --git a/libs/common/src/vault/services/cipher.service.ts b/libs/common/src/vault/services/cipher.service.ts
index 739bb084c74..8bb426c1ad3 100644
--- a/libs/common/src/vault/services/cipher.service.ts
+++ b/libs/common/src/vault/services/cipher.service.ts
@@ -50,7 +50,7 @@ import { LoginUri } from "../models/domain/login-uri";
 import { Password } from "../models/domain/password";
 import { SecureNote } from "../models/domain/secure-note";
 import { SortedCiphersCache } from "../models/domain/sorted-ciphers-cache";
-import { SSHKey } from "../models/domain/ssh-key";
+import { SshKey } from "../models/domain/ssh-key";
 import { CipherBulkDeleteRequest } from "../models/request/cipher-bulk-delete.request";
 import { CipherBulkMoveRequest } from "../models/request/cipher-bulk-move.request";
 import { CipherBulkRestoreRequest } from "../models/request/cipher-bulk-restore.request";
@@ -1543,8 +1543,8 @@ export class CipherService implements CipherServiceAbstraction {
           key,
         );
         return;
-      case CipherType.SSHKey:
-        cipher.sshKey = new SSHKey();
+      case CipherType.SshKey:
+        cipher.sshKey = new SshKey();
         await this.encryptObjProperty(
           model.sshKey,
           cipher.sshKey,
diff --git a/libs/importer/src/components/dialog/import-success-dialog.component.ts b/libs/importer/src/components/dialog/import-success-dialog.component.ts
index 01941d5512a..75e0754423e 100644
--- a/libs/importer/src/components/dialog/import-success-dialog.component.ts
+++ b/libs/importer/src/components/dialog/import-success-dialog.component.ts
@@ -53,7 +53,7 @@ export class ImportSuccessDialogComponent implements OnInit {
         case CipherType.Identity:
           identities++;
           break;
-        case CipherType.SSHKey:
+        case CipherType.SshKey:
           sshKeys++;
           break;
         default:
diff --git a/libs/vault/src/cipher-form/cipher-form-container.ts b/libs/vault/src/cipher-form/cipher-form-container.ts
index 60381df7297..8010cf260df 100644
--- a/libs/vault/src/cipher-form/cipher-form-container.ts
+++ b/libs/vault/src/cipher-form/cipher-form-container.ts
@@ -8,7 +8,7 @@ import { CustomFieldsComponent } from "./components/custom-fields/custom-fields.
 import { IdentitySectionComponent } from "./components/identity/identity.component";
 import { ItemDetailsSectionComponent } from "./components/item-details/item-details-section.component";
 import { LoginDetailsSectionComponent } from "./components/login-details-section/login-details-section.component";
-import { SSHKeySectionComponent } from "./components/sshkey-section/sshkey-section.component";
+import { SshKeySectionComponent } from "./components/sshkey-section/sshkey-section.component";
 
 /**
  * The complete form for a cipher. Includes all the sub-forms from their respective section components.
@@ -21,7 +21,7 @@ export type CipherForm = {
   autoFillOptions?: AutofillOptionsComponent["autofillOptionsForm"];
   cardDetails?: CardDetailsSectionComponent["cardDetailsForm"];
   identityDetails?: IdentitySectionComponent["identityForm"];
-  sshKeyDetails?: SSHKeySectionComponent["sshKeyForm"];
+  sshKeyDetails?: SshKeySectionComponent["sshKeyForm"];
   customFields?: CustomFieldsComponent["customFieldsForm"];
 };
 
diff --git a/libs/vault/src/cipher-form/components/cipher-form.component.html b/libs/vault/src/cipher-form/components/cipher-form.component.html
index 717b9a318ac..2644741385b 100644
--- a/libs/vault/src/cipher-form/components/cipher-form.component.html
+++ b/libs/vault/src/cipher-form/components/cipher-form.component.html
@@ -23,7 +23,7 @@
     ></vault-card-details-section>
 
     <vault-sshkey-section
-      *ngIf="config.cipherType === CipherType.SSHKey"
+      *ngIf="config.cipherType === CipherType.SshKey"
       [disabled]="config.mode === 'partial-edit'"
       [originalCipherView]="originalCipherView"
     ></vault-sshkey-section>
diff --git a/libs/vault/src/cipher-form/components/cipher-form.component.ts b/libs/vault/src/cipher-form/components/cipher-form.component.ts
index b9ec4672b5a..f77761d032a 100644
--- a/libs/vault/src/cipher-form/components/cipher-form.component.ts
+++ b/libs/vault/src/cipher-form/components/cipher-form.component.ts
@@ -40,7 +40,7 @@ import { CardDetailsSectionComponent } from "./card-details-section/card-details
 import { IdentitySectionComponent } from "./identity/identity.component";
 import { ItemDetailsSectionComponent } from "./item-details/item-details-section.component";
 import { LoginDetailsSectionComponent } from "./login-details-section/login-details-section.component";
-import { SSHKeySectionComponent } from "./sshkey-section/sshkey-section.component";
+import { SshKeySectionComponent } from "./sshkey-section/sshkey-section.component";
 
 @Component({
   selector: "vault-cipher-form",
@@ -64,7 +64,7 @@ import { SSHKeySectionComponent } from "./sshkey-section/sshkey-section.componen
     ItemDetailsSectionComponent,
     CardDetailsSectionComponent,
     IdentitySectionComponent,
-    SSHKeySectionComponent,
+    SshKeySectionComponent,
     NgIf,
     AdditionalOptionsSectionComponent,
     LoginDetailsSectionComponent,
diff --git a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
index 2e9207f8465..51b07a1cbf3 100644
--- a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
+++ b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.html
@@ -1,7 +1,7 @@
 <bit-section [formGroup]="sshKeyForm">
   <bit-section-header>
     <h2 bitTypography="h6">
-      {{ "typeSSHKey" | i18n }}
+      {{ "typeSshKey" | i18n }}
     </h2>
   </bit-section-header>
   <bit-card>
diff --git a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
index ab82fee26b9..a15237421bd 100644
--- a/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
+++ b/libs/vault/src/cipher-form/components/sshkey-section/sshkey-section.component.ts
@@ -34,7 +34,7 @@ import { CipherFormContainer } from "../../cipher-form-container";
     CommonModule,
   ],
 })
-export class SSHKeySectionComponent implements OnInit {
+export class SshKeySectionComponent implements OnInit {
   /** The original cipher */
   @Input() originalCipherView: CipherView;
 
diff --git a/libs/vault/src/cipher-view/cipher-view.component.html b/libs/vault/src/cipher-view/cipher-view.component.html
index 6c8fc46715d..280b972f6e1 100644
--- a/libs/vault/src/cipher-view/cipher-view.component.html
+++ b/libs/vault/src/cipher-view/cipher-view.component.html
@@ -22,7 +22,7 @@
   <app-view-identity-sections *ngIf="cipher.identity" [cipher]="cipher">
   </app-view-identity-sections>
 
-  <!-- SSHKEY SECTIONS -->
+  <!-- SshKEY SECTIONS -->
   <app-sshkey-view *ngIf="hasSshKey" [sshKey]="cipher.sshKey"></app-sshkey-view>
 
   <!-- ADDITIONAL OPTIONS -->
diff --git a/libs/vault/src/cipher-view/cipher-view.component.ts b/libs/vault/src/cipher-view/cipher-view.component.ts
index accd95ca7d4..3097478bf45 100644
--- a/libs/vault/src/cipher-view/cipher-view.component.ts
+++ b/libs/vault/src/cipher-view/cipher-view.component.ts
@@ -21,7 +21,7 @@ import { CustomFieldV2Component } from "./custom-fields/custom-fields-v2.compone
 import { ItemDetailsV2Component } from "./item-details/item-details-v2.component";
 import { ItemHistoryV2Component } from "./item-history/item-history-v2.component";
 import { LoginCredentialsViewComponent } from "./login-credentials/login-credentials-view.component";
-import { SSHKeyViewComponent } from "./sshkey-sections/sshkey-view.component";
+import { SshKeyViewComponent } from "./sshkey-sections/sshkey-view.component";
 import { ViewIdentitySectionsComponent } from "./view-identity-sections/view-identity-sections.component";
 
 @Component({
@@ -38,7 +38,7 @@ import { ViewIdentitySectionsComponent } from "./view-identity-sections/view-ide
     ItemHistoryV2Component,
     CustomFieldV2Component,
     CardDetailsComponent,
-    SSHKeyViewComponent,
+    SshKeyViewComponent,
     ViewIdentitySectionsComponent,
     LoginCredentialsViewComponent,
     AutofillOptionsViewComponent,
diff --git a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
index 7f403193d44..ee5a94249c4 100644
--- a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
+++ b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.html
@@ -1,6 +1,6 @@
 <bit-section>
   <bit-section-header>
-    <h2 bitTypography="h6">{{ "typeSSHKey" | i18n }}</h2>
+    <h2 bitTypography="h6">{{ "typeSshKey" | i18n }}</h2>
   </bit-section-header>
   <bit-card class="[&_bit-form-field:last-of-type]:tw-mb-0">
     <bit-form-field>
diff --git a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts
index 75b1975cab2..7f553dbe58b 100644
--- a/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts
+++ b/libs/vault/src/cipher-view/sshkey-sections/sshkey-view.component.ts
@@ -2,7 +2,7 @@ import { CommonModule } from "@angular/common";
 import { Component, Input } from "@angular/core";
 
 import { JslibModule } from "@bitwarden/angular/jslib.module";
-import { SSHKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
+import { SshKeyView } from "@bitwarden/common/vault/models/view/ssh-key.view";
 import {
   CardComponent,
   SectionComponent,
@@ -30,6 +30,6 @@ import { OrgIconDirective } from "../../components/org-icon.directive";
     IconButtonModule,
   ],
 })
-export class SSHKeyViewComponent {
-  @Input() sshKey: SSHKeyView;
+export class SshKeyViewComponent {
+  @Input() sshKey: SshKeyView;
 }

From 736b5290184e4166f796bb9ca61dafe19a051309 Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Sun, 20 Oct 2024 18:56:06 +0200
Subject: [PATCH 5/8] Fix libc dependency being duplicated

---
 apps/desktop/desktop_native/core/Cargo.toml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/apps/desktop/desktop_native/core/Cargo.toml b/apps/desktop/desktop_native/core/Cargo.toml
index 082fdf6992d..b8a4d23702f 100644
--- a/apps/desktop/desktop_native/core/Cargo.toml
+++ b/apps/desktop/desktop_native/core/Cargo.toml
@@ -32,12 +32,11 @@ base64 = "=0.22.1"
 byteorder = "1.5.0"
 cbc = { version = "=0.1.2", features = ["alloc"] }
 homedir = "0.3.3"
-libc = "=0.2.155"
+libc = "=0.2.159"
 pin-project = "1.1.5"
 dirs = "=5.0.1"
 futures = "=0.3.30"
 interprocess = { version = "=2.2.1", features = ["tokio"] }
-libc = "=0.2.159"
 log = "=0.4.22"
 rand = "=0.8.5"
 retry = "=2.0.0"

From 1d34ef456bafd0110f6c9339024edb787a98f441 Mon Sep 17 00:00:00 2001
From: aj-bw <81774843+aj-bw@users.noreply.github.com>
Date: Mon, 4 Nov 2024 07:10:30 -0500
Subject: [PATCH 6/8] fix SSH casing (#11840)

---
 apps/desktop/src/locales/en/messages.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/apps/desktop/src/locales/en/messages.json b/apps/desktop/src/locales/en/messages.json
index 9f84199610b..24d59950091 100644
--- a/apps/desktop/src/locales/en/messages.json
+++ b/apps/desktop/src/locales/en/messages.json
@@ -205,7 +205,7 @@
     "message": "A new SSH key was generated"
   },
   "sshAgentUnlockRequired": {
-    "message": "Please unlock your vault to approve the Ssh key request."
+    "message": "Please unlock your vault to approve the SSH key request."
   },
   "sshAgentUnlockTimeout": {
     "message": "SSH key request timed out."
@@ -214,10 +214,10 @@
     "message": "Enable SSH agent"
   },
   "enableSshAgentDesc": {
-    "message": "Enable the SSH agent to sign Ssh requests right from your Bitwarden vault."
+    "message": "Enable the SSH agent to sign SSH requests right from your Bitwarden vault."
   },
   "enableSshAgentHelp": {
-    "message": "The Ssh agent is a service targeted at developers that allows you to sign Ssh requests directly from your Bitwarden vault."
+    "message": "The SSH agent is a service targeted at developers that allows you to sign SSH requests directly from your Bitwarden vault."
   },
   "premiumRequired": {
     "message": "Premium required"
@@ -440,10 +440,10 @@
     "message": "Copy password"
   },
   "regenerateSshKey": {
-    "message": "Regenerate Ssh key"
+    "message": "Regenerate SSH key"
   },
   "copySshPrivateKey": {
-    "message": "Copy Ssh private key"
+    "message": "Copy SSH private key"
   },
   "copyUri": {
     "message": "Copy URI"

From 7d6b3dea44417699fa7f5fd1b1999283493efcdc Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Wed, 6 Nov 2024 15:10:29 +0100
Subject: [PATCH 7/8] Move ssh agent behind feature flag (#11841)

* Move ssh agent behind feature flag

* Add separate flag for ssh agent
---
 .../src/app/accounts/settings.component.html  |   2 +-
 .../src/app/accounts/settings.component.ts    |   6 +
 apps/desktop/src/app/services/init.service.ts |   2 +-
 apps/desktop/src/main.ts                      |  11 +-
 apps/desktop/src/platform/preload.ts          |   3 +
 .../platform/services/ssh-agent.service.ts    | 230 +++++++++---------
 libs/common/src/enums/feature-flag.enum.ts    |   2 +
 7 files changed, 140 insertions(+), 116 deletions(-)

diff --git a/apps/desktop/src/app/accounts/settings.component.html b/apps/desktop/src/app/accounts/settings.component.html
index 194bbdb3041..7336ce09dd8 100644
--- a/apps/desktop/src/app/accounts/settings.component.html
+++ b/apps/desktop/src/app/accounts/settings.component.html
@@ -419,7 +419,7 @@ <h2>
                   "enableHardwareAccelerationDesc" | i18n
                 }}</small>
               </div>
-              <div class="form-group">
+              <div class="form-group" *ngIf="showSshAgentOption">
                 <div class="checkbox">
                   <label for="enableSshAgent">
                     <input
diff --git a/apps/desktop/src/app/accounts/settings.component.ts b/apps/desktop/src/app/accounts/settings.component.ts
index 9b4467709b8..a8ce45f53c7 100644
--- a/apps/desktop/src/app/accounts/settings.component.ts
+++ b/apps/desktop/src/app/accounts/settings.component.ts
@@ -12,7 +12,9 @@ import { UserVerificationService as UserVerificationServiceAbstraction } from "@
 import { AutofillSettingsServiceAbstraction } from "@bitwarden/common/autofill/services/autofill-settings.service";
 import { DomainSettingsService } from "@bitwarden/common/autofill/services/domain-settings.service";
 import { DeviceType } from "@bitwarden/common/enums";
+import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action.enum";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
@@ -53,6 +55,7 @@ export class SettingsComponent implements OnInit, OnDestroy {
   showAlwaysShowDock = false;
   requireEnableTray = false;
   showDuckDuckGoIntegrationOption = false;
+  showSshAgentOption = false;
   isWindows: boolean;
   isLinux: boolean;
 
@@ -138,6 +141,7 @@ export class SettingsComponent implements OnInit, OnDestroy {
     private pinService: PinServiceAbstraction,
     private logService: LogService,
     private nativeMessagingManifestService: NativeMessagingManifestService,
+    private configService: ConfigService,
   ) {
     const isMac = this.platformUtilsService.getDevice() === DeviceType.MacOsDesktop;
 
@@ -201,6 +205,8 @@ export class SettingsComponent implements OnInit, OnDestroy {
     if (activeAccount == null || activeAccount.id == null) {
       return;
     }
+
+    this.showSshAgentOption = await this.configService.getFeatureFlag(FeatureFlag.SSHAgent);
     this.userHasMasterPassword = await this.userVerificationService.hasMasterPassword();
 
     this.isWindows = this.platformUtilsService.getDevice() === DeviceType.WindowsDesktop;
diff --git a/apps/desktop/src/app/services/init.service.ts b/apps/desktop/src/app/services/init.service.ts
index b411937a04d..627a9b62228 100644
--- a/apps/desktop/src/app/services/init.service.ts
+++ b/apps/desktop/src/app/services/init.service.ts
@@ -48,7 +48,7 @@ export class InitService {
 
   init() {
     return async () => {
-      this.sshAgentService.init();
+      await this.sshAgentService.init();
       this.nativeMessagingService.init();
       await this.stateService.init({ runMigrations: false }); // Desktop will run them in main process
 
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
index e93d93cc355..f869898d57b 100644
--- a/apps/desktop/src/main.ts
+++ b/apps/desktop/src/main.ts
@@ -1,6 +1,6 @@
 import * as path from "path";
 
-import { app } from "electron";
+import { app, ipcMain } from "electron";
 import { Subject, firstValueFrom } from "rxjs";
 
 import { AccountServiceImplementation } from "@bitwarden/common/auth/services/account.service";
@@ -72,6 +72,7 @@ export class Main {
   nativeMessagingMain: NativeMessagingMain;
   clipboardMain: ClipboardMain;
   desktopAutofillSettingsService: DesktopAutofillSettingsService;
+  sshAgentService: MainSshAgentService;
 
   constructor() {
     // Set paths for portable builds
@@ -241,8 +242,12 @@ export class Main {
     this.clipboardMain = new ClipboardMain();
     this.clipboardMain.init();
 
-    const sshAgent = new MainSshAgentService(this.logService, this.messagingService);
-    sshAgent.init();
+    ipcMain.handle("sshagent.init", async (event: any, message: any) => {
+      if (this.sshAgentService == null) {
+        this.sshAgentService = new MainSshAgentService(this.logService, this.messagingService);
+        this.sshAgentService.init();
+      }
+    });
 
     new EphemeralValueStorageService();
     new SSOLocalhostCallbackService(this.environmentService, this.messagingService);
diff --git a/apps/desktop/src/platform/preload.ts b/apps/desktop/src/platform/preload.ts
index f968073c7b8..35caeff27c8 100644
--- a/apps/desktop/src/platform/preload.ts
+++ b/apps/desktop/src/platform/preload.ts
@@ -42,6 +42,9 @@ const clipboard = {
 };
 
 const sshAgent = {
+  init: async () => {
+    await ipcRenderer.invoke("sshagent.init");
+  },
   setKeys: (keys: { name: string; privateKey: string; cipherId: string }[]): Promise<void> =>
     ipcRenderer.invoke("sshagent.setkeys", keys),
   signRequestResponse: async (requestId: number, accepted: boolean) => {
diff --git a/apps/desktop/src/platform/services/ssh-agent.service.ts b/apps/desktop/src/platform/services/ssh-agent.service.ts
index 49a25d3b106..dd518a943b8 100644
--- a/apps/desktop/src/platform/services/ssh-agent.service.ts
+++ b/apps/desktop/src/platform/services/ssh-agent.service.ts
@@ -19,6 +19,8 @@ import {
 
 import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
+import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
+import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { CommandDefinition, MessageListener } from "@bitwarden/common/platform/messaging";
@@ -49,123 +51,129 @@ export class SshAgentService implements OnDestroy {
     private toastService: ToastService,
     private i18nService: I18nService,
     private desktopSettingsService: DesktopSettingsService,
+    private configService: ConfigService,
   ) {}
 
-  init() {
-    this.messageListener
-      .messages$(new CommandDefinition("sshagent.signrequest"))
-      .pipe(
-        withLatestFrom(this.authService.activeAccountStatus$),
-        // This switchMap handles unlocking the vault if it is locked:
-        //   - If the vault is locked, we will wait for it to be unlocked.
-        //   - If the vault is not unlocked within the timeout, we will abort the flow.
-        //   - If the vault is unlocked, we will continue with the flow.
-        // switchMap is used here to prevent multiple requests from being processed at the same time,
-        // and will cancel the previous request if a new one is received.
-        switchMap(([message, status]) => {
-          if (status !== AuthenticationStatus.Unlocked) {
+  async init() {
+    const isSshAgentFeatureEnabled = await this.configService.getFeatureFlag(FeatureFlag.SSHAgent);
+    if (isSshAgentFeatureEnabled) {
+      await ipc.platform.sshAgent.init();
+
+      this.messageListener
+        .messages$(new CommandDefinition("sshagent.signrequest"))
+        .pipe(
+          withLatestFrom(this.authService.activeAccountStatus$),
+          // This switchMap handles unlocking the vault if it is locked:
+          //   - If the vault is locked, we will wait for it to be unlocked.
+          //   - If the vault is not unlocked within the timeout, we will abort the flow.
+          //   - If the vault is unlocked, we will continue with the flow.
+          // switchMap is used here to prevent multiple requests from being processed at the same time,
+          // and will cancel the previous request if a new one is received.
+          switchMap(([message, status]) => {
+            if (status !== AuthenticationStatus.Unlocked) {
+              ipc.platform.focusWindow();
+              this.toastService.showToast({
+                variant: "info",
+                title: null,
+                message: this.i18nService.t("sshAgentUnlockRequired"),
+              });
+              return this.authService.activeAccountStatus$.pipe(
+                filter((status) => status === AuthenticationStatus.Unlocked),
+                timeout(this.SSH_VAULT_UNLOCK_REQUEST_TIMEOUT),
+                catchError((error: unknown) => {
+                  if (error instanceof TimeoutError) {
+                    this.toastService.showToast({
+                      variant: "error",
+                      title: null,
+                      message: this.i18nService.t("sshAgentUnlockTimeout"),
+                    });
+                    const requestId = message.requestId as number;
+                    // Abort flow by sending a false response.
+                    // Returning an empty observable this will prevent the rest of the flow from executing
+                    return from(ipc.platform.sshAgent.signRequestResponse(requestId, false)).pipe(
+                      map(() => EMPTY),
+                    );
+                  }
+
+                  throw error;
+                }),
+                map(() => message),
+              );
+            }
+
+            return of(message);
+          }),
+          // This switchMap handles fetching the ciphers from the vault.
+          switchMap((message) =>
+            from(this.cipherService.getAllDecrypted()).pipe(
+              map((ciphers) => [message, ciphers] as const),
+            ),
+          ),
+          // This concatMap handles showing the dialog to approve the request.
+          concatMap(([message, decryptedCiphers]) => {
+            const cipherId = message.cipherId as string;
+            const requestId = message.requestId as number;
+
+            if (decryptedCiphers === undefined) {
+              return of(false).pipe(
+                switchMap((result) =>
+                  ipc.platform.sshAgent.signRequestResponse(requestId, Boolean(result)),
+                ),
+              );
+            }
+
+            const cipher = decryptedCiphers.find((cipher) => cipher.id == cipherId);
+
             ipc.platform.focusWindow();
-            this.toastService.showToast({
-              variant: "info",
-              title: null,
-              message: this.i18nService.t("sshAgentUnlockRequired"),
-            });
-            return this.authService.activeAccountStatus$.pipe(
-              filter((status) => status === AuthenticationStatus.Unlocked),
-              timeout(this.SSH_VAULT_UNLOCK_REQUEST_TIMEOUT),
-              catchError((error: unknown) => {
-                if (error instanceof TimeoutError) {
-                  this.toastService.showToast({
-                    variant: "error",
-                    title: null,
-                    message: this.i18nService.t("sshAgentUnlockTimeout"),
-                  });
-                  const requestId = message.requestId as number;
-                  // Abort flow by sending a false response.
-                  // Returning an empty observable this will prevent the rest of the flow from executing
-                  return from(ipc.platform.sshAgent.signRequestResponse(requestId, false)).pipe(
-                    map(() => EMPTY),
-                  );
-                }
-
-                throw error;
+            const dialogRef = ApproveSshRequestComponent.open(
+              this.dialogService,
+              cipher.name,
+              this.i18nService.t("unknownApplication"),
+            );
+
+            return dialogRef.closed.pipe(
+              switchMap((result) => {
+                return ipc.platform.sshAgent.signRequestResponse(requestId, Boolean(result));
               }),
-              map(() => message),
             );
-          }
-
-          return of(message);
-        }),
-        // This switchMap handles fetching the ciphers from the vault.
-        switchMap((message) =>
-          from(this.cipherService.getAllDecrypted()).pipe(
-            map((ciphers) => [message, ciphers] as const),
-          ),
-        ),
-        // This concatMap handles showing the dialog to approve the request.
-        concatMap(([message, decryptedCiphers]) => {
-          const cipherId = message.cipherId as string;
-          const requestId = message.requestId as number;
-
-          if (decryptedCiphers === undefined) {
-            return of(false).pipe(
-              switchMap((result) =>
-                ipc.platform.sshAgent.signRequestResponse(requestId, Boolean(result)),
-              ),
+          }),
+          takeUntil(this.destroy$),
+        )
+        .subscribe();
+
+      combineLatest([
+        timer(0, this.SSH_REFRESH_INTERVAL),
+        this.desktopSettingsService.sshAgentEnabled$,
+      ])
+        .pipe(
+          concatMap(async ([, enabled]) => {
+            if (!enabled) {
+              await ipc.platform.sshAgent.setKeys([]);
+              return;
+            }
+
+            const ciphers = await this.cipherService.getAllDecrypted();
+            if (ciphers == null) {
+              await ipc.platform.sshAgent.lock();
+              return;
+            }
+
+            const sshCiphers = ciphers.filter(
+              (cipher) => cipher.type === CipherType.SshKey && !cipher.isDeleted,
             );
-          }
-
-          const cipher = decryptedCiphers.find((cipher) => cipher.id == cipherId);
-
-          ipc.platform.focusWindow();
-          const dialogRef = ApproveSshRequestComponent.open(
-            this.dialogService,
-            cipher.name,
-            this.i18nService.t("unknownApplication"),
-          );
-
-          return dialogRef.closed.pipe(
-            switchMap((result) => {
-              return ipc.platform.sshAgent.signRequestResponse(requestId, Boolean(result));
-            }),
-          );
-        }),
-        takeUntil(this.destroy$),
-      )
-      .subscribe();
-
-    combineLatest([
-      timer(0, this.SSH_REFRESH_INTERVAL),
-      this.desktopSettingsService.sshAgentEnabled$,
-    ])
-      .pipe(
-        concatMap(async ([, enabled]) => {
-          if (!enabled) {
-            await ipc.platform.sshAgent.setKeys([]);
-            return;
-          }
-
-          const ciphers = await this.cipherService.getAllDecrypted();
-          if (ciphers == null) {
-            await ipc.platform.sshAgent.lock();
-            return;
-          }
-
-          const sshCiphers = ciphers.filter(
-            (cipher) => cipher.type === CipherType.SshKey && !cipher.isDeleted,
-          );
-          const keys = sshCiphers.map((cipher) => {
-            return {
-              name: cipher.name,
-              privateKey: cipher.sshKey.privateKey,
-              cipherId: cipher.id,
-            };
-          });
-          await ipc.platform.sshAgent.setKeys(keys);
-        }),
-        takeUntil(this.destroy$),
-      )
-      .subscribe();
+            const keys = sshCiphers.map((cipher) => {
+              return {
+                name: cipher.name,
+                privateKey: cipher.sshKey.privateKey,
+                cipherId: cipher.id,
+              };
+            });
+            await ipc.platform.sshAgent.setKeys(keys);
+          }),
+          takeUntil(this.destroy$),
+        )
+        .subscribe();
+    }
   }
 
   ngOnDestroy() {
diff --git a/libs/common/src/enums/feature-flag.enum.ts b/libs/common/src/enums/feature-flag.enum.ts
index 20d01277876..4565514cbb8 100644
--- a/libs/common/src/enums/feature-flag.enum.ts
+++ b/libs/common/src/enums/feature-flag.enum.ts
@@ -29,6 +29,7 @@ export enum FeatureFlag {
   DelayFido2PageScriptInitWithinMv2 = "delay-fido2-page-script-init-within-mv2",
   AccountDeprovisioning = "pm-10308-account-deprovisioning",
   SSHKeyVaultItem = "ssh-key-vault-item",
+  SSHAgent = "ssh-agent",
   NotificationBarAddLoginImprovements = "notification-bar-add-login-improvements",
   AC2476_DeprecateStripeSourcesAPI = "AC-2476-deprecate-stripe-sources-api",
   CipherKeyEncryption = "cipher-key-encryption",
@@ -76,6 +77,7 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.DelayFido2PageScriptInitWithinMv2]: FALSE,
   [FeatureFlag.AccountDeprovisioning]: FALSE,
   [FeatureFlag.SSHKeyVaultItem]: FALSE,
+  [FeatureFlag.SSHAgent]: FALSE,
   [FeatureFlag.NotificationBarAddLoginImprovements]: FALSE,
   [FeatureFlag.AC2476_DeprecateStripeSourcesAPI]: FALSE,
   [FeatureFlag.CipherKeyEncryption]: FALSE,

From f19612b3bb25045a85c44e08eb6cff6af6ac2367 Mon Sep 17 00:00:00 2001
From: Bernd Schoolmann <mail@quexten.com>
Date: Wed, 6 Nov 2024 19:21:58 +0100
Subject: [PATCH 8/8] [PM-14215] fix unsupported key type error message
 (#11788)

* Fix error message for import of unsupported ssh keys

* Use triple equals in add-edit component for ssh keys
---
 apps/desktop/src/locales/en/messages.json          |  3 +++
 .../src/vault/app/vault/add-edit.component.ts      | 14 ++++++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/apps/desktop/src/locales/en/messages.json b/apps/desktop/src/locales/en/messages.json
index 832e54de5f2..83fa064a35e 100644
--- a/apps/desktop/src/locales/en/messages.json
+++ b/apps/desktop/src/locales/en/messages.json
@@ -3297,6 +3297,9 @@
   "invalidSshKey": {
     "message": "The SSH key is invalid"
   },
+  "sshKeyTypeUnsupported": {
+    "message": "The SSH key type is not supported"
+  },
   "importSshKeyFromClipboard": {
     "message": "Import key from clipboard"
   },
diff --git a/apps/desktop/src/vault/app/vault/add-edit.component.ts b/apps/desktop/src/vault/app/vault/add-edit.component.ts
index b55ff2bf848..a3a9c929159 100644
--- a/apps/desktop/src/vault/app/vault/add-edit.component.ts
+++ b/apps/desktop/src/vault/app/vault/add-edit.component.ts
@@ -160,16 +160,22 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On
   async importSshKeyFromClipboard() {
     const key = await this.platformUtilsService.readFromClipboard();
     const parsedKey = await ipc.platform.sshAgent.importKey(key, "");
-    if (parsedKey == null || parsedKey.status == sshAgent.SshKeyImportStatus.ParsingError) {
+    if (parsedKey == null || parsedKey.status === sshAgent.SshKeyImportStatus.ParsingError) {
       this.toastService.showToast({
         variant: "error",
         title: "",
         message: this.i18nService.t("invalidSshKey"),
       });
       return;
+    } else if (parsedKey.status === sshAgent.SshKeyImportStatus.UnsupportedKeyType) {
+      this.toastService.showToast({
+        variant: "error",
+        title: "",
+        message: this.i18nService.t("sshKeyTypeUnsupported"),
+      });
     } else if (
-      parsedKey.status == sshAgent.SshKeyImportStatus.PasswordRequired ||
-      parsedKey.status == sshAgent.SshKeyImportStatus.WrongPassword
+      parsedKey.status === sshAgent.SshKeyImportStatus.PasswordRequired ||
+      parsedKey.status === sshAgent.SshKeyImportStatus.WrongPassword
     ) {
       this.toastService.showToast({
         variant: "error",
@@ -190,7 +196,7 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On
   }
 
   async typeChange() {
-    if (this.cipher.type == CipherType.SshKey) {
+    if (this.cipher.type === CipherType.SshKey) {
       await this.generateSshKey();
     }
   }