How to extract your private ssh key from gpg-agent

gistfile1.rst

How to extract a SSH private key from gpg-agent

Problem: Lost private key file ~/.ssh/id_rsa, but could connect to remote hosts via pubkey auth anyway: gpg-agent cached the private key. How to get the private key?

Solution: Use gpg-protect-tool to get the key (you need to know the passphrase of course):

gpgsm --call-protect-tool --p12-export ~/.gnupg/private-keys-v1.d/your-keyfile.key >key.p12

Now you have a PKCS12 file and you can extract the private key like this:

openssl pkcs12 -in key.p12 -out privkey.pem

And there is your extracted private key.

While this is blocked on support in an up-to-date gpgsm you can just use an old version .. for example Debian 8 "Jessie" has gpgsm (GnuPG) 2.0.26, which still has --p12-export. The quickest way for me to use it was in a container, something like this:

$ docker run --rm -it -v ~/.gnupg:/gnupg debian:8
root@f12e2268d754:/# apt update && apt install -y gpgsm
[...]
root@f12e2268d754:/# gpgsm --call-protect-tool --p12-export /gnupg/private-keys-v1.d/KEYGRIP.key > /gnupg/lostkey.p12
root@f12e2268d754:/# exit
$ openssl pkcs12 -in ~/.gnupg/lostkey.p12 -out ~/privkey.pem

While this is blocked on support in an up-to-date gpgsm you can just use an old version .. for example Debian 8 "Jessie" has gpgsm (GnuPG) 2.0.26, which still has --p12-export. The quickest way for me to use it was in a container, something like this:

$ docker run --rm -it -v ~/.gnupg:/gnupg debian:8
root@f12e2268d754:/# apt update && apt install -y gpgsm
[...]
root@f12e2268d754:/# gpgsm --call-protect-tool --p12-export /gnupg/private-keys-v1.d/KEYGRIP.key > /gnupg/lostkey.p12
root@f12e2268d754:/# exit
$ openssl pkcs12 -in ~/.gnupg/lostkey.p12 -out ~/privkey.pem

tried, but it didn't work on my ed25519 key, complaing about "error converting key parameters". seems doesn't support ed25519.
But I have decrypted my key and get q,d two integers, finding way to construct final openssh keys.

nvm. I have managed to recover my private key by decrypt original key and using cryptography Python library.
if you decrypted your key, there is a d section which is 32 bytes long. Use that in cryptography library to reconstruct your OpenSSH key.