Ssh – Does Gnome Keyring support new-format OpenSSH private keys

gnome-keyringopensshsshssh-agentssh-keygen

Does gnome-keyring support SSH private keys that are saved in the newer OpenSSH file format? Will Gnome Keyring automatically import those private keys?

In more detail: When generating a SSH private key, ssh-keygen can save the private key in the newer OpenSSH format (rather than the "more compatible PEM format"). With this format, the private key file begins with "-----BEGIN OPENSSH PRIVATE KEY-----".

I just generated a new RSA private key for SSH and saved it in the newer format, using ssh-keygen -t rsa -b 3072 -o -a 16. Now Gnome Keyring doesn't seem to be able to load that private key. In contrast, everything seems to work fine when using ssh-agent.

When using Gnome Keyring with this new private key, I see the following error messages in /var/log/messages:

gnome-keyring-daemon[10904]: invalid or unrecognized private SSH key: [key id]
gnome-keyring-daemon[10904]: signing of the data failed: The operation failed

and when I try to run ssh, I see the following error message in my terminal:

sign_and_send_pubkey: signing failed: agent refused operation

If it's relevant, I'm using Fedora 25 with MATE, with gnome-keyring-3.20.0-1.fc25.x86_64.

Best Answer

Things have changed slightly now. As a result GNOME 3.28 now wraps OpenSSH's ssh-agent, which gives it the same level of support as OpenSSH.

Reference - Archlinux wiki - GNOME/Keyring

Known issues

Cannot handle ECDSA and Ed25519 keys

As of January 2018, GNOME Keyring doesn't handle ECDSA nor Ed25519 keys. You can turn to other SSH agents if you need support for those.

Note: As of GNOME 3.28, gnome-keyring replaced its SSH agent implementation with a wrapper around the ssh-agent tool that comes with openssh. As a result, any type of key supported by the upstream ssh-agent is now also supported by gnome-keyring, including ECDSA and Ed25519 keys.

If you still find that you're behind this particular version this Gist shows how you can use keychain to workaround this issue, titled: SSH with ed25519 (curve25519) + GNOME-KeyRing.

References

Related Question