ssh fine w/pubkey only, nonstandard port and passphrase for local keypair but cvs isn't

I have no problems using ssh or scp with an sshd configured for pubkey
only and my local keypair requiring a passphrase before authn. I have my
sshd running on a nonstandard port (to cut down on scans).

Yet I can't seem to configure CVSROOT to allow cvs from cmdline (cygwin)
or my IDE (NetBeans) to allow a commit.

I always get the message that pubkey failed.

I am unsure even after googling whether CVSROOT permits non-standard
ports or local passphrase for pubkey authn....is all of this possible?


thanks in advance,

mike