Q: MacOS Sierra not properly accessing keychain passphrases for SSH/OpenSSL

Hi,

There seems to be a problem in MacOS Sierra regarding the passphrases for SSH keys.

I have my public/private keypair enabled for accessing some linux servers, so I can SSH into them without inserting my passwords. After the upgrade to macOS sierra, it seems that the keychain is no longer processing/storing/retrieving the passphrases properly.

When first tried to login into one of my remote servers, I was asked for the passphrase, which seemed weird, so I thought that perhaps the passphrases were lost in the upgrade and changed the passphrase manually by invoking "ssh-keygen -f id_rsa -p". Then I proceeded to login again, I was asked for the passphrase and entered it, so I could login into the server, but then, regardless of SSH telling me that it has stored the new passphrase in the keychain, following attempts to login again always ask me for the passphrase.

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/xxxxx/.ssh/id_rsa.pub
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: pkalg ssh-rsa blen 535
debug2: input_userauth_pk_ok: fp SHA256:/xxxxxxxxx/GM
debug3: sign_and_send_pubkey: RSA SHA256:/xxxxxxxx/GM
debug3: Search for item with query: {
    acct = "/Users/xxxxx/.ssh/id_rsa.pub";
    agrp = "com.apple.ssh.passphrases";
    class = genp;
    labl = "SSH: /Users/xxxxx/.ssh/id_rsa.pub";
    nleg = 1;
    "r_Data" = 1;
    svce = OpenSSH;
}
debug2: Passphrase not found in the keychain. Enter passphrase for key '/Users/xxxxx/.ssh/id_rsa.pub': debug2: no passphrase given, try next key
debug1: Offering RSA public key: /Users/xxxxx/.ssh/id_rsa
debug3: send_pubkey_test
...
debug2: storing passphrase in keychain debug3: Search for existing item with query: {
    acct = "/Users/xxxxx/.ssh/id_rsa";
    agrp = "com.apple.ssh.passphrases";
    class = genp;
    labl = "SSH: /Users/xxxxx/.ssh/id_rsa";
    nleg = 1;
    "r_Ref" = 1;
    svce = OpenSSH;
}
debug3: Item already exists in the keychain, updating. debug3: send packet: type 50
debug3: receive packet: type 52
debug1: Authentication succeeded (publickey).

Please note how it fails to find the passphrase in the keychain (this is the second and following attempts' output), then it says that it stores the passphrase in the keychain, and then it finds it and "updates" it. However, next attempt will not find the passphrase in the keychain, so the process will repeat "ad nauseam".