Preamble
My understanding of gpg and ssh is medium-technical as a programmer and crypto-fan, but I'm not a huge pro in either's nitty-gritty details like configuration, "trivia" like alphabet soup specs, magic variables, and interoperation. I've been through a few hours of reading guides and troubleshootings, and a few years of light linux server use, and I've gotten through much so far, but I'm stuck now.
Goal
To set up gpg4win with a master key with 1 auth subkey, that lets me authenticate in git and ssh via gpg-agent with a password prompt via gpg4win.
Sitrep
Windows 10 pc, linux server on LAN for testing. ssh, putty, kitty, and pageant already set up and working with an older gpg key + derived putty key of mine. Kleopatra shows everything to be working, password prompt and gpg-agent included. gpg4win 3.1.7, gnupg 2.2.15, putty/kitty 0.71.
I've generated a new master key 9B59 for myself using ECC (ed25519), Certify-only. Generated 2 ECC subkeys (1 Encrypt, 1 Authenticate+Sign).
AS subkey:
- id =
F3DC - keygrip =
3289...224A gpg --export-ssh-key ...=ssh-ed25519 AAAAC3Nz... openpgp:0x6146F3DC.
AS subkey keygrip added to ~\gnupg\sshcontrol, ssh key added to server's ~/authorized_keys.
gpg-agent running with --enable-putty-support --enable-ssh-support. Trying to run pageant fails with an error that "pageant is already running", indicating that ssh support is online (and no, there is no instance of pageant running).
SSH_AUTH_SOCK env var = C:\Users\me\AppData\Roaming\gnupg\S.gpg-agent.ssh. This file exists, is always "last modified on" at the time of gpg-agent starting, and contains some binary foobar.
gpg-connect-agent -r keyinfo_list.txt reported (among other keys):
S KEYINFO 3289...224A D - - - P - - -
Trying to authenticate to my ssh server at this point failed against my expectation with "no supported auth methods (publickey)", and did not prompt for my password via gpg4win.
After performing an operation in Kleopatra to force the key to be loaded, the previous output changed to
S KEYINFO 3289...224A D - - 1 P - - -
so my AS subkey F3DC is correctly loaded and cached.
At this point authentication through putty/kitty using "pageant" (= gpg-agent) still did not work.
The putty event log of the failed login shows:
Event Log: Pageant is running. Requesting keys.
Event Log: Pageant has 0 SSH-2 keys
Q
Why is gpg-agent not offering to use my AS subkey despite it being loaded in gpg-agent, set in sshcontrol, and listed in my authorized_keys?
