2

I am migrating from ssh-agent to gpg-agent now and I also have a bunch of ssh keys, which are loaded at startup. The keys do not contain passphrases, but after calling ssh-add <filename>, gpg-agent asks for a passphrase. Just pressing Enter works fine, but could it not ask for passphrases at all? At least for the keys not having one?

  • Does that mean that there was no asking for the passphrase without gpg-agent? – Hauke Laging Feb 6 '14 at 1:02
  • @hauke-laging ssh-add (or ssh-agent) didn’t initiate launch of what was set in ASKPASS_PROGRAM if a key had no passphrase. – tijagi Feb 9 '14 at 6:54
5

Edit: I'm leaving this here for Google, but having bumped into this myself I no longer think this is the real problem.

gpg-agent likes to copy your keys and put its own pass-phrase protection on them when you ssh-add them the first time. From https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html

SSH Keys, which are to be used through the agent, need to be added to the gpg-agent initially through the ssh-add utility. When a key is added, ssh-add will ask for the password of the provided key file and send the unprotected key material to the agent; this causes the gpg-agent to ask for a passphrase, which is to be used for encrypting the newly received key and storing it in a gpg-agent specific directory.

So it could be that that's what's happening, unless it keeps happening for the same keys. If they had passphrases originally I think you would get asked twice, once to unlock it and once to re-encrypt it.

  • I don’t use any agent for ssh keys binding them in ~/.ssh/config, but accepting that because gokuro-sama – tijagi Nov 21 '14 at 3:25
0

It seems like gpg-agent doesn't understand the concept of a key without a passphrase. In that case, you don't want to ssh-add your passphrase-less keys to gpg-agent at all, just let SSH find them by itself. To undo the caching, what worked for me was to delete the ~/.gnupg directory; after that, I could use my unprotected key without any bother. I would hope there's a safer way to remove cached gpg keys, but I can't find it.

  • Don't delete your ~/.gnupg ! It has your public and private keys! – lionello Apr 16 '18 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.