I am migrating from ssh-agent to gpg-agent now and I also have a bunch of ssh keys, which are loaded at startup. The keys do not contain passphrases, but after calling ssh-add <filename>, gpg-agent asks for a passphrase. Just pressing Enter works fine, but could it not ask for passphrases at all? At least for the keys not having one?

  • Does that mean that there was no asking for the passphrase without gpg-agent? Feb 6, 2014 at 1:02
  • @hauke-laging ssh-add (or ssh-agent) didn’t initiate launch of what was set in ASKPASS_PROGRAM if a key had no passphrase.
    – tijagi
    Feb 9, 2014 at 6:54

2 Answers 2


Edit: I'm leaving this here for Google, but having bumped into this myself I no longer think this is the real problem.

gpg-agent likes to copy your keys and put its own pass-phrase protection on them when you ssh-add them the first time. From https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html

SSH Keys, which are to be used through the agent, need to be added to the gpg-agent initially through the ssh-add utility. When a key is added, ssh-add will ask for the password of the provided key file and send the unprotected key material to the agent; this causes the gpg-agent to ask for a passphrase, which is to be used for encrypting the newly received key and storing it in a gpg-agent specific directory.

So it could be that that's what's happening, unless it keeps happening for the same keys. If they had passphrases originally I think you would get asked twice, once to unlock it and once to re-encrypt it.

  • I don’t use any agent for ssh keys binding them in ~/.ssh/config, but accepting that because gokuro-sama
    – tijagi
    Nov 21, 2014 at 3:25
  • Is there any way to get gpg-agent to cache SSH keys without the extra passphrase but only in RAM? I'd also be fine if it just generated random large secret that it knows itself, rather than asking me. My SSH keys are already encrypted on disk, its weird to decrypt, then re-encrypt with another key...
    – Yarek T
    May 7 at 10:26

It seems like gpg-agent doesn't understand the concept of a key without a passphrase. In that case, you don't want to ssh-add your passphrase-less keys to gpg-agent at all, just let SSH find them by itself. To undo the caching, what worked for me was to delete the ~/.gnupg directory; after that, I could use my unprotected key without any bother. I would hope there's a safer way to remove cached gpg keys, but I can't find it.

  • 5
    Don't delete your ~/.gnupg ! It has your public and private keys!
    – lionello
    Apr 16, 2018 at 7:37
  • ssh-add keys are stored in ~/.gnupg/private-keys-v1.d directory. You can check by looking in sshcontrol file, as well as gpg-connect-agent 'keyinfo --list' /bye command (1 in the 7th column indicates the key is cached). Don't delete your ~/.gnupg dir
    – Yarek T
    May 7 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .