Does gnome-keyring support SSH private keys that are saved in the newer OpenSSH file format? Will Gnome Keyring automatically import those private keys?

In more detail: When generating a SSH private key, ssh-keygen can save the private key in the newer OpenSSH format (rather than the "more compatible PEM format"). With this format, the private key file begins with "-----BEGIN OPENSSH PRIVATE KEY-----".

I just generated a new RSA private key for SSH and saved it in the newer format, using ssh-keygen -t rsa -b 3072 -o -a 16. Now Gnome Keyring doesn't seem to be able to load that private key. In contrast, everything seems to work fine when using ssh-agent.

When using Gnome Keyring with this new private key, I see the following error messages in /var/log/messages:

gnome-keyring-daemon[10904]: invalid or unrecognized private SSH key: [key id]
gnome-keyring-daemon[10904]: signing of the data failed: The operation failed

and when I try to run ssh, I see the following error message in my terminal:

sign_and_send_pubkey: signing failed: agent refused operation

If it's relevant, I'm using Fedora 25 with MATE, with gnome-keyring-3.20.0-1.fc25.x86_64.

2 Answers 2


Alas, it appears that Gnome Keyring doesn't support the new-style file format for private keys, as far as I can tell. At least, there are two bug reports on Gnome Keyring's bug tracker that make this claim:

  • Bug 750986 says PBKDF2 isn't supported. PBKDF2 is enabled by default for the new file format.

  • Bug 702529 says the new file format isn't supported (see comment 1).

  • 2
    The ed25519 is not supported either.
    – Jakuje
    Commented Feb 24, 2017 at 8:18

Things have changed slightly now. As a result GNOME 3.28 now wraps OpenSSH's ssh-agent, which gives it the same level of support as OpenSSH.

Reference - Archlinux wiki - GNOME/Keyring

Known issues

Cannot handle ECDSA and Ed25519 keys

As of January 2018, GNOME Keyring doesn't handle ECDSA nor Ed25519 keys. You can turn to other SSH agents if you need support for those.

Note: As of GNOME 3.28, gnome-keyring replaced its SSH agent implementation with a wrapper around the ssh-agent tool that comes with openssh. As a result, any type of key supported by the upstream ssh-agent is now also supported by gnome-keyring, including ECDSA and Ed25519 keys.

If you still find that you're behind this particular version this Gist shows how you can use keychain to workaround this issue, titled: SSH with ed25519 (curve25519) + GNOME-KeyRing.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .