SSH_AUTH_SOCK for key?

[tcurdt]

Could it be possible to use a key via SSH_AUTH_SOCK?

Scenario: I ssh into a server and want to encrypt/decrypt with the same key used for the ssh connection.

[cipriancraciun]

I don't think age supports this use-case directly, because the ssh-agent doesn't provide encryption / decryption functionality, it exposes only signing functionality. (From what I know, age supports using the ~/.ssh/identity_* files directly itself, without any mediation from the SSH tools.)

Theoretically you could use a ssh-agent to encrypt something by passing "some key" through its signature algorithm, but it would only work with RSA and Ed25519 keys, not with ECDSA keys (because for these the signature is not deterministic.)

However such a usage is perhaps not recommended by cryptographers.

That being said, I think I remember seeing some plugins or discussions on the age GitHub issues and discussions that touch upon this topic. (I don't have right now the links to those projects; however they were all experimental.)

---

And, as a shameless plug, I was working this year on a small project that implements exactly what you are looking for, namely encrypting small pieces of data (up to 128 MiB) with ssh-agent keys, exactly targeting the use-case you are looking for. However, this project is also experimental, but if you want to use it we can discuss (on its project discussion page) about how to integrate it into your workflow.

My project I've mentioned is https://github.com/volution/z-tokens (the "exchange" feature of it).

I've also opened a thread in my project on the subject of using SSH-agent for encryption:
=> volution/z-tokens#29

[cipriancraciun]

I was searching my own notes about the subject (because I did research it while developing the tool I've mentioned), and remembered I've also written an article about the topic (shameless plug again: https://notes.volution.ro/v1/2023/05/remarks/faf953cf/), which listed a few other projects that you could use (which unfortunately have nothing to do with age):

• https://github.com/leighmcculloch/sshcrypt
• https://github.com/ndilieto/libagentcrypt
• https://github.com/Sets88/ssh-crypt