6

I need to export one of my GPG keys as a PKCS12 key/certificate. gpg is incapable of doing this, but the tool gpgsm is. However, entering gpgsm -o <file> --export-secret-key-p12 <key-id> returns gpgsm: can't export secret key `<key-id>'. I tested gpgsm --list-keys and it returned nothing.

Is GPGSM supposed to work with GPG? I noticed that on my first time running it a new file was created for it. I'd assume that it wouldn't have to if GPG has already been run and configured. Are both mean to have access to the same keyring? If so, how do I fix this? If not, how can I export my key from GPG and import it into GPGSM?

|improve this question
3

It would be more useful to describe why you want to do something, not just what you want to do. I'm guessing that you're trying to use your PGP key with S/MIME email encryption or signing, which isn't really possible.

To answer the question, no, GPG and GPGSM use different formats and protocols, which is why they're implemented as separate tools in the first place. GPG is an implementation of OpenPGP, while GPGSM works with X.509 (mostly S/MIME).

While both use the same cryptographic algorithms and could in theory use the same key material (e.g. identical RSA parameters), that's where the similarity ends – you cannot translate an OpenPGP user certificate directly to an X.509 certificate, therefore you cannot usefully export it in PKCS#12 format either.

(gpg-agent is capable of using OpenPGP keys for SSH authentication, but that's only because the SSH key format has no metadata attached, so the "conversion" is merely extracting the RSA parameters. On the other hand, X.509 certificates have such metadata as the subject name which uses a different syntax from OpenPGP; issuer name which OpenPGP doesn't have (being based on web-of-trust); and key usage (which is tricky since most OpenPGP implementations use two separate keys within a single 'certificate', one for signing and one for encrypting).)

|improve this answer
  • So how could extract the RSA/DSA keys raw and import them? – Melab Nov 7 '14 at 3:37
  • How is that useful at all? (Edit your key to set a blank passphrase, --export-secret-key, dump it using pgpdump -i.) – grawity Nov 7 '14 at 5:55
  • I can use the same keys. – Melab Nov 10 '14 at 2:13
  • 2
    @Melab: Which has completely no useful difference from just generating a new keypair. You get no value from reusing a key from another cryptosystem (i.e. from PGP to S/MIME), because it won't carry over the metadata nor the trust that other people have marked it with. The only thing it makes easier is having the key compromised, because it's stored in more places. – grawity Nov 10 '14 at 5:36
  • 1
    (Generally, the only time this is useful is for programs that were specifically written to work with two systems at once, e.g. GnuPG's ability to use a PGP key (and therefore a PGP smartcard) for SSH authentication. So what you suggest is only useful if you had such a card and if gpgsm knew how to use a PGP smartcard with X.509 certificates, which it doesn't.) – grawity Nov 10 '14 at 5:40
0

Not a direct answer to your question, but CACert has published a Wiki entry detailing what you want to do.

Essentially you would generate a certificate signing request using the secret key you exported from your keypair and have a certificate created by a CA like CACert.

I just fail to export to a p12 file format on Windows using gpgsm, but on Linux this was not a problem.

Source: http://wiki.cacert.org/ConvertingPgpKeyToCertificate

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.