1 [[!meta title="MonkeySphere can't deal with passphrase-locked primary keys"]]
3 At the moment, the only tool we have to export passphrase-locked
4 secret keys from the GPG keyring is `gpg` itself (and `gpg2`, which
5 has roughly the same behavior).
7 As a result, we have the `seckey2sshagent` hack, which is unfriendly
10 Ideally, `openpgp2ssh` would be able to convert passphrase-locked
11 secret keys into clean subkeys. However, i've tried to do this via
12 GnuTLS, and that library is not ready for this.
14 OpenCDK, which is the component of GnuTLS which reads OpenPGP-style
15 keys, cannot cope with encrypted secret key material. I have had
17 success](http://lists.gnu.org/archive/html/gnutls-devel/2008-06/msg00092.html)
18 in getting GnuTLS's OpenCDK to accept the existence of encrypted
19 secret key packets, [i learned that OpenCDK as included in GnuTLS is
20 incapable of dealing with the encrypted packets
21 themselves](http://lists.gnu.org/archive/html/gnutls-devel/2008-07/msg00012.html).
24 Some possible resolutions:
28 If we can assume that the passphrase-encrypted key we want to use is
29 actually a subkey, and if we could fix GnuTLS to ignore the use of the
30 "gnu-dummy S2K" produced by `gpg --export-secret-subkeys` for the
31 primary key, then something like the following script should actually
32 work for reasonable values of `$KEYID`:
36 mkfifo "$TMPDIR/passphrase"
37 kname="MonkeySphere Key $KEYID"
38 mkfifo "$TMPDIR/$kname"
39 ssh-askpass "Please enter the passphrase for MonkeySphere key $KEYID" >"$TMPDIR/passphrase" &
40 gpg --passphrase-fd 3 3<"$TMPDIR/passphrase" \
41 --export-options export-reset-subkey-passwd,export-minimal,no-export-attributes \
42 --export-secret-subkeys "$KEYID"\! | openpgp2ssh "$KEYID" > "$TMPDIR/$kname" &
43 (cd "$TMPDIR" && ssh-add -c "$kname")
46 Good news! [I've crafted a patch for GnuTLS to enable it to read
47 exported subkeys using this GNU
48 extension](http://lists.gnu.org/archive/html/gnutls-devel/2008-08/msg00005.html),
49 so if we can get it incorporated into upstream (and/or into debian),
50 we have a possible solution, as long as the authentication key is a
51 subkey, and not a primary key.
53 As of version 0.11-1, `monkeysphere subkey-to-ssh-agent` implements
54 this particular strategy (and fails cleanly if the version of GnuTLS
55 present doesn't support the GNU dummy S2K extension).
59 Ben Laurie and Rachel Willmer's
60 [OpenPGPSDK](http://openpgp.nominet.org.uk) is a candidate: this is a
61 C-based library that intends to implement RFC 4880 functionality.
63 We could potentially re-write `openpgp2ssh` using this library, and it
64 *should* be able to handle everything we need from the OpenPGP side
65 (though it might need to be re-linked to OpenSSL to handle PEM-encoded
70 * OpenPGPSDK is not in debian yet, and doesn't currently (2008-08-13)
71 build with gcc 4.2 or 4.3.
73 * OpenPGPSDK uses the apache license and appears to link to OpenSSL,
74 which has a GPL-incompatible license. I think this would mean that
75 `openpgp2ssh` could not remain GPL (though the rest of the
80 We could try to use perl. The last time i checked, the pure-perl
81 OpenPGP implementations all depended on Math::PARI, which [is not in
82 debian](http://bugs.debian.org/440527). The most likely candidate is
83 [Crypt::OpenPGP](http://search.cpan.org/~btrott/Crypt-OpenPGP),
85 bugginess](http://cpanratings.perl.org/dist/Crypt-OpenPGP).
89 * the aforementioned buggy reviews
91 * there's a lot of dependency chasing to get anything like this
100 Can this bug be closed? dkg [reported in a comment for a related
101 bug](/bugs/install-seckey2sshagent-in-usr-bin/):
103 Version 0.11-1 now has the monkeysphere subkey-to-ssh-agent
104 subcommand, which works cleanly in the presence of a
105 functionally-patched GnuTLS.
109 Even with the patched GnuTLS, monkeysphere currently can't currently
110 deal with passphrase-locked primary keys. I've changed the title of
111 this bug, but i'd like to keep it open until we are able to deal with
112 that. The other comments here seem still quite relevant to that
115 I've changed the title of this bug to reflect the narrowed scope.