I want to generate an
RSA key in
GPG and use it in
SSH login. Is this even possible? If so, how?
I'm doing some research about this topic and I can give you some hints, but I've not found a way to make it work yet.
Monkeysphere seems a very interesting project, but I've not been able to compile it under Mac OS X without clogging my little free disk space with MacPorts.
The first way I suggest you to try is to generate a compatible authorized_keys entry from your key id (e.g. BFB2E5E3) with
Here I added it to my localhost since I ran an ssh server for testing purposes, but of course you should add this to the target host
gpg-agent has the option
But I don't think this will ever work. The manpage says:
So it seems that gpg-agent should be used as an additional measure to protect your SSH keys with a GPG encryption.
Converting a GPG key to OpenSSH
Jérôme Pouiller in his blog writes that Gpgsm utility can exports keys and certificate in PCSC12 and than used by OpenSSH using gpgsm:
But I haven't find a way to make gpgsm accept my gpg keypairs.
Other things you can try
Still I miss a way to put it all together
No, they are not interchangeable. Yes, it is possible to use GPG keys for authentication – the Monkeysphere package has tools to extract the raw RSA keypair from your GPG certificate.
Somewhat relevant: this gnupg-users thread.
With the information from the answers on this question and the help of the gnupg-users mailinglist I was able to figure out how to use my GPG key for SSH authentication. As already mentioned by Claudio Floreani in his answer, there are a few possible methods to do this.
I have written a blogpost about some possible solutions: http://budts.be/weblog/2012/08/ssh-authentication-with-your-pgp-key
To summarize: Either you use GnuPG 2.1, which is currently in beta. When using this version, you can simply start gpg-agent with the --enable-ssh-support option and add the keygrip for you GPG key (or subkey) into ~/.gnupg/sshcontrol.
When you are using the current stable GnuPG version (2.0.x) you can use monkeysphere to add your key to gpg-agent (again, after starting gpg-agent with the --enable-ssh-support option).
It is also possible to use GNOME keyring (or even the regular ssh-agent) with the help of monkeysphere. The only problem in this case is that you will have to re-add your key when logging on again (into Gnome or XFCE). To solve this you can manually export your key and convert it.