2 I think there was a public/private typo.
source | link

OK, to recap what I think happens when adding a pkcs#8 private key, which leads to failure:

  1. Generate a keypair using ssh-keygen (no passphrase)
  2. Encrypt using openssl pkcs8 -topk8
  3. If the encrypted identity file is stored in ~/.ssh along with the matching public key, ssh-agent will add it to its keyring
  4. ssh-agent won't prompt you to decrypt the key, perhaps thinking it's unencrypted?
  5. When trying to connect, ssh-agent can't sign anything with the private key because it's still encrypted

Somthing with ssh-agent's auto-key-adding feature seems to screw up. When a pkcs#8 encrypted private key is automatically added by ssh-agent, it's not decrypting it.

Workaround

For new keys:

  1. Use ssh-keygen to genereate a keypair, do not save them in ~/.ssh!
  2. Encrypt the key using openssl pkcs8 -topk8 -in ~/id_rsa -out ~/id_rsa_enc -v2 des3

To fix existing keys:

  1. Move all private and public keys out of ~/.ssh
  2. Check with ssh-add -l, use -d to delete if neccesary

Either way:

  1. Move only the publicprivate key: mv ~/id_rsa_enc ~/.ssh/id_rsa
  2. Add this to ssh-agent: ssh-add
  3. You will now be prompted to enter your passphrase, enter it
  4. Check if the private key was added successfully using ssh-add -l
  5. Move your public key: mv ~/id_rsa.pub ~/.ssh/id_rsa.pub
  6. Check the public key with ssh-add -L

An additional ssh-agent -k or reboot might be useful. Please let me know if this works for you.

OK, to recap what I think happens when adding a pkcs#8 private key, which leads to failure:

  1. Generate a keypair using ssh-keygen (no passphrase)
  2. Encrypt using openssl pkcs8 -topk8
  3. If the encrypted identity file is stored in ~/.ssh along with the matching public key, ssh-agent will add it to its keyring
  4. ssh-agent won't prompt you to decrypt the key, perhaps thinking it's unencrypted?
  5. When trying to connect, ssh-agent can't sign anything with the private key because it's still encrypted

Somthing with ssh-agent's auto-key-adding feature seems to screw up. When a pkcs#8 encrypted private key is automatically added by ssh-agent, it's not decrypting it.

Workaround

For new keys:

  1. Use ssh-keygen to genereate a keypair, do not save them in ~/.ssh!
  2. Encrypt the key using openssl pkcs8 -topk8 -in ~/id_rsa -out ~/id_rsa_enc -v2 des3

To fix existing keys:

  1. Move all private and public keys out of ~/.ssh
  2. Check with ssh-add -l, use -d to delete if neccesary

Either way:

  1. Move only the public key: mv ~/id_rsa_enc ~/.ssh/id_rsa
  2. Add this to ssh-agent: ssh-add
  3. You will now be prompted to enter your passphrase, enter it
  4. Check if the private key was added successfully using ssh-add -l
  5. Move your public key: mv ~/id_rsa.pub ~/.ssh/id_rsa.pub
  6. Check the public key with ssh-add -L

An additional ssh-agent -k or reboot might be useful. Please let me know if this works for you.

OK, to recap what I think happens when adding a pkcs#8 private key, which leads to failure:

  1. Generate a keypair using ssh-keygen (no passphrase)
  2. Encrypt using openssl pkcs8 -topk8
  3. If the encrypted identity file is stored in ~/.ssh along with the matching public key, ssh-agent will add it to its keyring
  4. ssh-agent won't prompt you to decrypt the key, perhaps thinking it's unencrypted?
  5. When trying to connect, ssh-agent can't sign anything with the private key because it's still encrypted

Somthing with ssh-agent's auto-key-adding feature seems to screw up. When a pkcs#8 encrypted private key is automatically added by ssh-agent, it's not decrypting it.

Workaround

For new keys:

  1. Use ssh-keygen to genereate a keypair, do not save them in ~/.ssh!
  2. Encrypt the key using openssl pkcs8 -topk8 -in ~/id_rsa -out ~/id_rsa_enc -v2 des3

To fix existing keys:

  1. Move all private and public keys out of ~/.ssh
  2. Check with ssh-add -l, use -d to delete if neccesary

Either way:

  1. Move only the private key: mv ~/id_rsa_enc ~/.ssh/id_rsa
  2. Add this to ssh-agent: ssh-add
  3. You will now be prompted to enter your passphrase, enter it
  4. Check if the private key was added successfully using ssh-add -l
  5. Move your public key: mv ~/id_rsa.pub ~/.ssh/id_rsa.pub
  6. Check the public key with ssh-add -L

An additional ssh-agent -k or reboot might be useful. Please let me know if this works for you.

1
source | link

OK, to recap what I think happens when adding a pkcs#8 private key, which leads to failure:

  1. Generate a keypair using ssh-keygen (no passphrase)
  2. Encrypt using openssl pkcs8 -topk8
  3. If the encrypted identity file is stored in ~/.ssh along with the matching public key, ssh-agent will add it to its keyring
  4. ssh-agent won't prompt you to decrypt the key, perhaps thinking it's unencrypted?
  5. When trying to connect, ssh-agent can't sign anything with the private key because it's still encrypted

Somthing with ssh-agent's auto-key-adding feature seems to screw up. When a pkcs#8 encrypted private key is automatically added by ssh-agent, it's not decrypting it.

Workaround

For new keys:

  1. Use ssh-keygen to genereate a keypair, do not save them in ~/.ssh!
  2. Encrypt the key using openssl pkcs8 -topk8 -in ~/id_rsa -out ~/id_rsa_enc -v2 des3

To fix existing keys:

  1. Move all private and public keys out of ~/.ssh
  2. Check with ssh-add -l, use -d to delete if neccesary

Either way:

  1. Move only the public key: mv ~/id_rsa_enc ~/.ssh/id_rsa
  2. Add this to ssh-agent: ssh-add
  3. You will now be prompted to enter your passphrase, enter it
  4. Check if the private key was added successfully using ssh-add -l
  5. Move your public key: mv ~/id_rsa.pub ~/.ssh/id_rsa.pub
  6. Check the public key with ssh-add -L

An additional ssh-agent -k or reboot might be useful. Please let me know if this works for you.