Convert keys between GnuPG, OpenSsh and OpenSSL
Par Jérôme Pouiller le mercredi, mars 24 2010, 16:47 - Technique - Lien permanent
OpenSSH to OpenSSL
OpenSSH private keys are directly understable by OpenSSL:
openssl rsa -in ~/.ssh/id_rsa -text openssl dsa -in ~/.ssh/id_dsa -text
So, you can directly create certification request:
openssl req -new -key ~/.ssh/id_dsa -out mykey.csr
Notice I have not found how to manipulate ssh public key with OpenSSL
OpenSSL to OpenSSH
Private keys format is same between OpenSSL and OpenSSH, but not public key format. Nevertheless, you extract public key from private key file:
ssh-keygen -y -f id_rsa > id_rsa.pub
GnuPG to OpenSSL
Gpgsm utility can exports keys and certificate in PCSC12:
gpgsm -o secret-gpg-key.p12 --export-secret-key-p12 0xXXXXXXXX
You have to extract Key and Certificates separatly:
openssl pkcs12 -in secret-gpg-key.p12 -nocerts -out gpg-key.pem openssl pkcs12 -in secret-gpg-key.p12 -nokeys -out gpg-certs.pem
You can now use it in OpenSSL.
You can also do similar thing with GnuPG public keys. There will be only certificates output.
OpenSSL to GnuPG
Invert process:
openssl pkcs12 -export -in gpg-certs.pem -inkey gpg-key.pem -out gpg-key.p12 gpgsm --import gpg-key.p12
GnuPG to OpenSSH
Now, chain processes:
gpgsm -o secret-gpg-key.p12 --export-secret-key-p12 0xXXXXXXXX openssl pkcs12 -in secret-gpg-key.p12 -nocerts -out gpg-key.pem
We need to protect key, else ssh refuse it.
chmod 600 gpg-key.pem cp gpg-key.pem ~/.ssh/id_rsa ssh-keygen -y -f gpg-key.pem > ~/.ssh/id_rsa.pub
OpenSSH to GnuPG
First we need to create a certificate (self-signed) for our ssh key:
openssl req -new -x509 -key ~/.ssh/id_rsa -out ssh-cert.pem
We can now import it in GnuPG
openssl pkcs12 -export -in ssh-certs.pem -inkey ~/.ssh/id_rsa -out ssh-key.p12 gpgsm --import ssh-key.p12
Notice you cannot import/export DSA ssh keys to/from GnuPG