For a backup scenario, I want to peform asymmetric encryption of the data. For this I'm using duplicati (2.0) paired with GPG.

Now I have a smartcard (PKCS#11 / CSP interface via OpenSC) on which I have a 2048-bit RSA private key. I have a copy of OpenSSL on my machine as well as XCA (which supports the usual formats SSH2 / PEM / DER) with private-key access.

My aim is to add the public key, corresponding to the private key as an encryption subkey to my existing software-based keyring with an 4096-bit primary software RSA key. It would also be sufficient to add it "normally" as "somebody else's public key".

Now my question is:
How can I convert a PEM / SSH2 / DER encoded public key so that it will be accepted by GPG as a public RSA key?

Please note: "The key formats serve different purposes" is not a valid answer

If you want to suggest "use gpgsm" as an answer, please document how to do so with duplicati.

1 Answer 1


After some additional thought I've come up with a "quick and dirty" solution to this problem.

Duplicati requires the the program to be called "gpg.exe", there's no way around that. However, one is allowed to specify a path where to find the executable and one is allowed to fully customize the command-line parameters (main sub-program) and switches .

This allows one to specify a static (sub-path) where one would put gpgsm and all dependencies and rename gpgsm.exe to gpg.exe. Afterwards one just simply locally imports a self-signed certificate (created with XCA) for the encryption target.

  • This sounds like a clever use of the rarely used gpgsm. If this works out, this seems like something that should be reported upstream, asking for an option that allows calling a different GnuPG "implementation".
    – Jens Erat
    Apr 10, 2016 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .