For a backup scenario, I want to peform asymmetric encryption of the data. For this I'm using duplicati (2.0) paired with GPG.

Now I have a smartcard (PKCS#11 / CSP interface via OpenSC) on which I have a 2048-bit RSA private key. I have a copy of OpenSSL on my machine as well as XCA (which supports the usual formats SSH2 / PEM / DER) with private-key access.

My aim is to add the public key, corresponding to the private key as an encryption subkey to my existing software-based keyring with an 4096-bit primary software RSA key. It would also be sufficient to add it "normally" as "somebody else's public key".

Now my question is:
How can I convert a PEM / SSH2 / DER encoded public key so that it will be accepted by GPG as a public RSA key?

Please note: "The key formats serve different purposes" is not a valid answer

If you want to suggest "use gpgsm" as an answer, please document how to do so with duplicati.


After some additional thought I've come up with a "quick and dirty" solution to this problem.

Duplicati requires the the program to be called "gpg.exe", there's no way around that. However, one is allowed to specify a path where to find the executable and one is allowed to fully customize the command-line parameters (main sub-program) and switches .

This allows one to specify a static (sub-path) where one would put gpgsm and all dependencies and rename gpgsm.exe to gpg.exe. Afterwards one just simply locally imports a self-signed certificate (created with XCA) for the encryption target.

  • This sounds like a clever use of the rarely used gpgsm. If this works out, this seems like something that should be reported upstream, asking for an option that allows calling a different GnuPG "implementation". – Jens Erat Apr 10 '16 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.