4

I am migrating from ssh-agent to gpg-agent now and I also have a bunch of ssh keys, which are loaded at startup. The keys do not contain passphrases, but after calling ssh-add <filename>, gpg-agent asks for a passphrase. Just pressing Enter works fine, but could it not ask for passphrases at all? At least for the keys not having one?

2
  • Does that mean that there was no asking for the passphrase without gpg-agent? Feb 6, 2014 at 1:02
  • @hauke-laging ssh-add (or ssh-agent) didn’t initiate launch of what was set in ASKPASS_PROGRAM if a key had no passphrase.
    – tijagi
    Feb 9, 2014 at 6:54

2 Answers 2

6

Edit: I'm leaving this here for Google, but having bumped into this myself I no longer think this is the real problem.

gpg-agent likes to copy your keys and put its own pass-phrase protection on them when you ssh-add them the first time. From https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html

SSH Keys, which are to be used through the agent, need to be added to the gpg-agent initially through the ssh-add utility. When a key is added, ssh-add will ask for the password of the provided key file and send the unprotected key material to the agent; this causes the gpg-agent to ask for a passphrase, which is to be used for encrypting the newly received key and storing it in a gpg-agent specific directory.

So it could be that that's what's happening, unless it keeps happening for the same keys. If they had passphrases originally I think you would get asked twice, once to unlock it and once to re-encrypt it.

1
  • I don’t use any agent for ssh keys binding them in ~/.ssh/config, but accepting that because gokuro-sama
    – tijagi
    Nov 21, 2014 at 3:25
0

It seems like gpg-agent doesn't understand the concept of a key without a passphrase. In that case, you don't want to ssh-add your passphrase-less keys to gpg-agent at all, just let SSH find them by itself. To undo the caching, what worked for me was to delete the ~/.gnupg directory; after that, I could use my unprotected key without any bother. I would hope there's a safer way to remove cached gpg keys, but I can't find it.

1
  • 3
    Don't delete your ~/.gnupg ! It has your public and private keys!
    – lionello
    Apr 16, 2018 at 7:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .