FS#40552 - [gnupg] can't add ECDSA ssh key to gpg-agent
Attached to Project:
Arch Linux
Opened by viq (viq) - Sunday, 25 May 2014, 21:14 GMT
Last edited by Gaetan Bisson (vesath) - Monday, 23 June 2014, 17:14 GMT
Opened by viq (viq) - Sunday, 25 May 2014, 21:14 GMT
Last edited by Gaetan Bisson (vesath) - Monday, 23 June 2014, 17:14 GMT
|
Details
Description:
I'm trying to make gpg-agent work as ssh-agent as well, and while it adds rsa keys just fine, it refuses to add an ecdsa key despite wiki claiming it should https://wiki.archlinux.org/index.php/Ssh_keys#GnuPG_Agent I'm using gnome, but I made sure that keyring is disabled for ssh and gpg: $ env | egrep '(SSH|GPG)' SSH_AGENT_PID=863 GPG_AGENT_INFO=/tmp/gpg-SFziBP/S.gpg-agent:863:1 SSH_AUTH_SOCK=/tmp/gpg-yLa85e/S.gpg-agent.ssh SSH_ASKPASS=/usr/lib/ssh/x11-ssh-askpass Additional info: * package version(s) - gnupg 2.0.22-2 * config files: $ cat .gnupg/gpg.conf | grep -v ^# | grep -v ^$ require-cross-certification keyserver hkp://keys.gnupg.net use-agent $ cat .gnupg/gpg-agent.conf enable-ssh-support # Cache settings default-cache-ttl 10800 default-cache-ttl-ssh 10800 # Environment file write-env-file /home/viq/.gnupg/gpg-agent.env # Keyboard control #no-grab # PIN entry program pinentry-program /usr/bin/pinentry-curses #pinentry-program /usr/bin/pinentry-qt4 #pinentry-program /usr/bin/pinentry-kwallet #pinentry-program /usr/bin/pinentry-gtk-2 $ cat /etc/profile.d/gpg-agent.sh if [ $EUID -ne 0 ] ; then envfile="$HOME/.gnupg/gpg-agent.env" logfile="$HOME/.gnupg/gpg-agent.log" if [[ -e "$envfile" ]] && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then eval "$(cat "$envfile")" else eval "$(gpg-agent --daemon --verbose --enable-ssh-support --write-env-file "$envfile" --log-file "$logfile")" fi export GPG_AGENT_INFO # the env file does not contain the export statement export SSH_AUTH_SOCK # enable gpg-agent for ssh fi Steps to reproduce: $ ssh-keygen -t ecdsa -b 521 $ ssh-add .ssh/id_ecdsa Enter passphrase for .ssh/id_ecdsa: SSH_AGENT_FAILURE Could not add identity: .ssh/id_ecdsa |
This task depends upon
Closed by Gaetan Bisson (vesath)
Monday, 23 June 2014, 17:14 GMT
Reason for closing: Fixed
Additional comments about closing: gnupg-2.0.23-2 in [testing]
Monday, 23 June 2014, 17:14 GMT
Reason for closing: Fixed
Additional comments about closing: gnupg-2.0.23-2 in [testing]
I think back then it was at version 2.0.22.
According to mail thread "gpg-agent: SSH_AGENT_FAILURE when adding an ECDSA key" in arch-general, the recent libgcrypt 1.6+ update broke ECDSA in gpg-agent. One also claims that gnupg master branch has a fix, but looking through the git log [1] I can find any obvious commit.
[1] http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=summary
The libgcrypt functions such as gcry_pk_map_name() return GCRY_PK_ECC instead of GCRY_PK_ECDSA. So I modified gnupg 2.0.23 sources with this patch:
diff --git a/common/ssh-utils.c b/common/ssh-utils.c
index d8f057d..987966f 100644
--- a/common/ssh-utils.c
+++ b/common/ssh-utils.c
@@ -89,7 +89,7 @@ get_fingerprint (gcry_sexp_t key, void **r_fpr, size_t *r_len,
elems = "pqgy";
gcry_md_write (md, "\0\0\0\x07ssh-dss", 11);
break;
- case GCRY_PK_ECDSA:
+ case GCRY_PK_ECC:
/* We only support the 3 standard curves for now. It is just a
quick hack. */
elems = "q";
Now I am able to add a ECDSA via ssh-add:
[anatol@argo gnupg]$ ps ax | grep agent
8921 ? Ss 0:00 gpg-agent --daemon --enable-ssh-support
[anatol@argo gnupg]$ echo $SSH_AUTH_SOCK
/tmp/gpg-MQPevx/S.gpg-agent.ssh
[anatol@argo gnupg]$ echo $SSH_AGENT_PID
8921
[anatol@argo gnupg]$ ssh-add -l
2048 f4:a7:bd:43:fc:aa:ab:f2:f2:ff:6b:f3:9b:37:96:be /home/anatol/.ssh/id_rsa (RSA)
521 87:e8:e1:f6:1b:64:aa:58:ff:97:1a:20:5d:91:46:d7 /home/anatol/.ssh/id_ecdsa (ECDSA)
I do not know if this 1-line change is enough to fix all the libgcrypt 1.6 problems - I still wait any reply from gnupg developers. But at least I can 'ssh' into my machine without typing the passphrase.