Detecting the remaining lifetime of an ssh-agent identity

Question

The ssh-add command lets you specify the lifetime of an identity being added to ssh-agent. For example, if I type

ssh-add -t 1h

the identify will expire after 1 hour. I can then list the identities currently represented by the agent using ssh-add -l.

Is there a way (other than recording information when I run the ssh-add command) to determine the remaining lifetime of an identity? If not, is there some security-related reason why there shouldn't be a way to get this information?

Answer 1

No, there is no interface in ssh-agent communication protocol to provide this information. It is used only when adding the key (constraint array), but this is not returned when you list the keys, as the PROTOCOL.agent page describes (there is only key blob and comment for each key).

Requiring this would probably require to change the protocol, which is a run for a long distance.