Using GPG to decrypt age encrypted files?

[Ciantic]

I made this tool that converts GPG ed25519 to cv25519 encryption key.

Now my next step is to find out if I use ed25519 key to encrypt file in age can I somehow (not directly) decrypt it with GPG. I might need to splice the parts of age encrypted file, but I don't see why it wouldn't be possible.

Has anyone tried? Is this possible?

Reason I'm doing this, is of course

YubiKeys can't be used to decrypt files.

Which makes age annoying. But GPG can be used to decrypt files when keys are stored in YubiKey.

[FiloSottile]

Note that SSH keys stored on YubiKeys can't be used to decrypt files.

You can use age and YubiKeys seamlessly with https://github.com/str4d/age-plugin-yubikey.

[FiloSottile]

I see. That might work. If it was me, instead of modifying the ciphertext into something that would trick gpg into doing the right thing, I would write an age plugin that uses the gpg-agent protocol (or even the OpenPGP applet directly, if the agent protocol doesn't expose the right primitive) to decrypt the ssh-ed25519 stanza.

[Ciantic]

If I made age plugin which uses gpg-agent protocol could I reuse the SSH key stored in YubiKey to decrypt? Problem is that if someone sends me age encrypted file, I still need to have SSH key locally, and that I don't want.

Since YubiKey supports GPG CV25519 to decrypt files, I thought best way is to just reuse that so I don't need to have local copy.

[FiloSottile]

Again, my recommendation is not to use SSH keys if you can avoid it, and use age-plugin-yubikey instead.

But yes, I think such a plugin is possible, assuming the gpg-agent protocol is willing to decrypt using an authentication key slot.

[dominikh]

@Ciantic Have you made any progress on this?

[Ciantic]

@dominikh yes, but I ran out of steam. I believe it is possible, to create a special GPG key yourself.

1. convert between ed25519 and cv25519
2. Then use GPG-agent's API (which is undocumented, but I figured out from their C code) to decipher the secrets

To use the raw API here is an example:

https://github.com/Ciantic/gpg-ed25519-to-cv25519/blob/master/example-pkdecrypt-pksign/run.sh

To convert between keys same repository has code.

Unfortunately, I don't have time to do any support, if you are determined you can figure it out from there.

[pinpox]

I have received an age-encrypted file, which was encrypted using the age key derived from my ssh public key. My problem is, that I use GPG for ssh and thus don't have a private key to decrypt the file.

I started building a tool to derive age keys from GPG and then stumbled accros this dicussion, but the decryption still fails: https://github.com/pinpox/gpg2age/

Has anyone had any success or would be willing to take at the code?

[ritiek]

Thanks. I was able to extract my ssh private key using your tool.

I started building a tool to derive age keys from GPG and then stumbled accros this dicussion, but the decryption still fails

I presume this is no longer an issue now since it worked for me?

[pinpox]

No longer an issue, my problem is solved by my tool (see above)