OPENPGP2SSH(1)

✨ OPENPGP2SSH ✨

okay bestie, so openpgp2ssh is a lil command-line icon that translates OpenPGP keys into SSH keys 💅 this manual page lives in the General Commands Manual section, and it's giving "tiny tool, big job" energy fr fr.

---

🌸 SYNOPSIS 🌸

openpgp2ssh < mykey.gpg

gpg --export $KEYID | openpgp2ssh $KEYID

gpg --export $KEYID | openpgp2pem $KEYID

gpg --export $KEYID | openpgp2spki $KEYID

gpg --export-secret-key $KEYID | openpgp2ssh $KEYID

---

💖 DESCRIPTION 💖

so the way this works is: it takes an OpenPGP-formatted primary key plus the associated subkeys on standard input, and spits out the equivalent SSH-style (or PEM-encoded) key you asked for on standard output. slay. ✨

if the data on standard input contains no subkeys, you can invoke it with no arguments at all. no biggie. but if the data on standard input contains multiple keys (think: a primary key and its associated subkeys), then you must specify a specific OpenPGP key identifier as the first argument, so it knows which key to export. the key ID is normally the 40 hex digit OpenPGP fingerprint of the key or subkey you want — but it will also accept as few as the last 8 digits of the fingerprint as a key ID. yes queen, it's flexible. 🫶

if the input contains an OpenPGP RSA public key, it gets converted to the OpenSSH-style single-line keystring, prefixed with the key type (ssh-rsa). that format is suitable (with minor alterations, okurrr) for insertion into known_hosts files and authorized_keys files. and if you invoke it as openpgp2pem, a PEM-encoded public key gets emitted instead. 🌈

if you invoke it as openpgp2spki, a PEM-encoded subjectPublicKeyInfo (as defined in the X.509 standard) gets emitted instead. fancy. 👑

if the input contains an OpenPGP RSA secret key, it gets converted to the equivalent PEM-encoded private key. 💜

and btw, this tool is part of the monkeysphere(7) framework for providing a PKI for SSH. iykyk. 🐒

---

🙈 CAVEATS 🙈

real talk, read this part, bestie. it matters.

the keys produced by this process are stripped of all identifying information, including certifications, self-signatures, etc. and that is intentional — because ssh attaches no inherent significance to these features. so like, don't come for it, it's by design. 💀

this tool will produce output for any requested RSA key. which means, among other things, that it will happily export revoked keys, unverifiable keys, expired keys, etc. not a vibe check in sight. so please, make sure you do your own key validation before using this tool! periodt. ⚠️

---

🎀 EXAMPLES 🎀

gpg --export-secret-key $KEYID | openpgp2ssh $KEYID | ssh-add -c /dev/stdin

this pushes the secret key into the active ssh-agent(1). tools such as ssh(1) that know how to talk to ssh-agent(1) can now rely on the key. main character energy for real. 🔥

---

👑 AUTHOR 👑

the tool itself and this man page were written by Daniel Kahn Gillmor <dkg@fifthhorseman.net>. icon behaviour honestly. 💖

---

💀 BUGS 💀

• it only works with RSA keys. DSA keys are the only other key type available in both OpenPGP and SSH, but they are currently unsupported by this utility. sad but true. 😭
• it only accepts raw OpenPGP packets on standard input. it does not accept ASCII-armored input. right now it only exports into formats used by the OpenSSH. it should support other key output formats, such as those used by lsh(1) and putty(1). (emphasis on should, bestie.) 🙈
• secret key output is currently not passphrase-protected. 🫣
• it currently cannot handle passphrase-protected secret keys on input. 💀

---

🌈 SEE ALSO 🌈

pem2openpgp(1), monkeysphere(1), monkeysphere(7), ssh(1), monkeysphere-authentication(8), monkeysphere-host(8)

---

okay that's the whole page, bestie, you ate it. 🍓 this one's from the Debian fam and it's dated January 18,, 2013 — and yes, the double comma is canon, i don't make the rules, i just report them. 💅✨🦋