Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to generate an RSA key in GPG and use it in SSH login. Is this even possible? If so, how?

share|improve this question
add comment

3 Answers

up vote 10 down vote accepted

I'm doing some research about this topic and I can give you some hints, but I've not found a way to make it work yet.

Monkeysphere

Monkeysphere seems a very interesting project, but I've not been able to compile it under Mac OS X without clogging my little free diskspace with MacPorts.

Using gpgkey2ssh

The first way I suggest you to try is to generate a compatible authorized_keys entry from your key id (e.g. BFB2E5E3) with

gpgkey2ssh BFB2E5E3 |tee -a ~/.ssh/authorized_keys

Here I added it to my localhost since I ran an ssh server for testing purposes, but of course you should add this to the target host ~/.ssh/authorized_keys. Next you need to tell SSH to use the private portion of this key during authentication, but simply exporting an ASCII armored version of the keypair doesn't work

gpg --armor --export-secret-key BFB2E5E3! |tee ~/.ssh/id_rsa
gpg --armor --export BFB2E5E3! |tee ~/.ssh/id_rsa.pub
chmod 400 ~/.ssh/id_rsa
ssh localhost

Using gpg-agent

gpg-agent has the option "--enable-ssh-support" that allows it to use it as a drop-in replacement for the well known ssh-agent. I've read of some people trying to add via ssh-add their GPG key after launching gpg-agent this way: gpg-agent --enable-ssh-support --daemon gpg --armor --export-secret-key BFB2E5E3! |tee ~/.gnupg/exported-keys/BFB2E5E3_sec.asc ssh-add ~/.gnupg/exported-keys/BFB2E5E3_sec.asc

But I don't think this will ever work. The manpage says: "SSH Keys, which are to be used through the agent, need to be added to the gpg-agent initially through the ssh-add utility. When a key is added, ssh-add will ask for the password of the provided key file and send the unprotected key material to the agent; this causes the gpg-agent to ask for a passphrase, which is to be used for encrypting the newly received key and storing it in a gpg-agent specific directory." So it seems that gpg-agent should be used as an additional measure to protect your SSH keys with a GPG encryption.

Converting a GPG key to OpenSSH

Jérôme Pouiller in his blog writes that Gpgsm utility can exports keys and certificate in PCSC12 and than used by OpenSSH using gpgsm:

gpgsm -o secret-gpg-key.p12 --export-secret-key-p12 0xXXXXXXXX
openssl pkcs12 -in secret-gpg-key.p12 -nocerts -out gpg-key.pem
chmod 600 gpg-key.pem
cp gpg-key.pem ~/.ssh/id_rsa
ssh-keygen -y -f gpg-key.pem > ~/.ssh/id_rsa.pub

But I haven't find a way to make gpgsm accept my gpg keypairs.

Other things you can try

SSH has -I option to specify the PKCS#11 shared library ssh should use to communicate with a PKCS#11 token providing the user's private RSA key. ssh-keygen can use RFC4716/SSH2 public or private key, PEM PKCS8 public keys, and PEM public keys to generate an OpenSSH compatible private (or public) key using -i and -m options. Still I miss a way to put it all toghether

share|improve this answer
add comment

No, they are not interchangeable. Yes, it is possible to use GPG keys for authentication – the Monkeysphere package has tools to extract the raw RSA keypair from your GPG certificate.

  1. Your GPG certificate will need a subkey with the "authentication" capability flag. To create such a subkey, run once:

    monkeysphere g
    
  2. Now add your authentication subkeys to ssh-agent:

    monkeysphere s
    

Somewhat relevant: this gnupg-users thread.

share|improve this answer
add comment

With the information from the answers on this question and the help of the gnupg-users mailinglist I was able to figure out how to use my GPG key for SSH authentication. As already mentioned by Claudio Floreani in his answer, there are a few possible methods to do this.

I have written a blogpost about some possible solutions: http://budts.be/weblog/2012/08/ssh-authentication-with-your-pgp-key

To summarize: Either you use GnuPG 2.1, which is currently in beta. When using this version, you can simply start gpg-agent with the --enable-ssh-support option and add the keygrip for you GPG key (or subkey) into ~/.gnupg/sshcontrol.

When you are using the current stable GnuPG version (2.0.x) you can use monkeysphere to add your key to gpg-agent (again, after starting gpg-agent with the --enable-ssh-support option).

It is also possible to use GNOME keyring (or even the regular ssh-agent) with the help of monkeysphere. The only problem in this case is that you will have to re-add your key when logging on again (into Gnome or XFCE). To solve this you can manually export your key and convert it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.