1

Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL?

I've tried this:

$ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key
$ openssl rsautl -sign -in testfile -inkey secret.key -out test.sign

But that gives me this error:

unable to load Private Key 140543167485592:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:701:Expecting: ANY PRIVATE KEY

What am I doing wrong?

2

While OpenPGP and X.509 mostly share the same cryptographic algorithms, they have completely different representations of the key material. GnuPG (or to be more specific, gpg; gpgsm implements S/MIME and X.509 but not OpenPGP and is also part of GnuPG) does not "speak" X.509, OpenSSL does not support OpenPGP.

While you could well extract the numbers forming the keys and then construct a new key of the other format, these would still seem like different keys: due to the different protocols you cannot read messages encrypted in the other system, you cannot verify signatures issued by this. Even the keys are not obviously comparable, key identifiers are constructed differently, and finally the two systems share different trust systems.

To wrap up: theoretically you could construct a new key (not really convert it, as meta information is lost and other information is missing). There is no actual use in doing so, thus nobody cared about writing proper tooling for the process.

0

You need to convert the key to the correct format -

gpg2 --export-secret-keys
     --export-options export-reset-subkey-passwd,export-minimal,no-export-attributes 
     --no-armor 84E2C2E5 | openpgp2ssh 84E2C2E5 > id_rsa

Why are you trying to do this? Why not just sign the document with gpg?

gpg2 --sign document.doc
  • I'm trying to examine if a "gpg-signature" differs from an "openssl-signature". Your first line does not work for me. Although the id_rsa-file is generated, openpgp2ssh says: "We cannot handle encrypted secret keys. Skipping!" And openssl rsautl -sign -in test2 -inkey id_rsa -out test.sign does not work either. – user1511417 Nov 13 '17 at 14:44
  • @user1511417 see update to arguments to export encrypted. – Hector Nov 13 '17 at 14:48
  • It's still not working: gpg2 does not know the export option 'export-reset-subkey-passwd' – user1511417 Nov 13 '17 at 14:52
  • I've version gpg (GnuPG) 2.1.11 installed here. – user1511417 Nov 13 '17 at 14:53
  • 1
    Also look at OpenSSL's CMS and S/MIME signatures, both detached/clear and embedded, which are a much closer analog to GPG/PGP. – dave_thompson_085 Nov 14 '17 at 1:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.