I've been using a ssh key for a while by opening it using gpg agent. I do remember the gpg agent password, but I don't remember the ssh key.
How could I recover the ssh key from the gpg agent?
gpg-agent emulates ssh-agent. Auth requests are sent to the agent, and agent returns the authentication. You can't retrieve any private key but only public keys from the agent. It is designed in this way on purpose for security.
The agent will never send a private key over its request channel. Instead, operations that require a private key will be performed by the agent, and the result will be returned to the requester. This way, private keys are not exposed to clients using the agent.
If you want to get back your public key, you can interact with the gpg agent with ssh-add just as what you did with ssh agent.
# list public keys from the agent
ssh-add -L
Update: detail about how key challenges work.
When you connect to a server with SSH, the server doesn't directly ask you for the private key and passphrase to do the authentication, because sending them over the net is insecure.
Instead, when the server wants to authenticate you're who you claim to be, it sends you a request calculated with your public key. To complete the auth, you have to calculate a response with the private key and the request, and send the response back to the requester.
The gpg agent is an agent for you to handle the response. It does store the private key and passphrase. But it's designed in a way such that you can't retrieve them out of the agent.
-
Well, maybe I didn't get something then. When I try to connect to ssh, a window pops up, and ask me for something like my main passphrase (which is different from my private key passphrase). Then, it automatically unlock my ssh key, so I guess that "somehow", gpg knows the passphrase of my secret key no? I no, who knows it on my system? – tobiasBora Sep 11 '19 at 13:15
-
@tobiasBora If the SSH key has a passphrase, then this must have been given when it was added to the agent. – Kusalananda♦ Sep 11 '19 at 13:29
-
@tobiasBora The passphrase is given when then a first time a request is sent from the server to the client. And the passphrase is stored in the agent to let the agent do following authentication response for you automatically. But you can't retrieve it out of the agent, it's designed in this way. – Simba Sep 11 '19 at 13:36
-
Thanks. But I guess it's impossible to make sure the passphrase can't be recover: if the agent can, a "modified" agent could learn it as well... So I guess it should be either possible to write a modified version of the agent, or directly to spy the actual agent, using something like trace or something more involved... If anyone has some methods, I'm very curious! – tobiasBora Sep 12 '19 at 13:23
-
(I accept the answer for now, but if somebody find an actual method to recover the private key please let me know!) – tobiasBora Sep 12 '19 at 13:23
