key-transform 1.0.1__py3-none-any.whl

key_transform/main.py

@@ -0,0 +1,146 @@
+from __future__ import annotations
+
+from typing import IO
+
+import click
+import pgpy
+import pgpy.constants
+from cryptography.hazmat.primitives.asymmetric import ec, rsa
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.serialization import (
+    BestAvailableEncryption,
+    Encoding,
+    PrivateFormat,
+    PublicFormat,
+)
+from pgpy.constants import KeyFlags
+
+
+class TransformError(Exception):
+    pass
+
+
+@click.group(context_settings={"max_content_width": 120})
+def cli() -> None:
+    pass
+
+
+def output_ssh_key(
+    pgp_key: pgpy.PGPKey, key: ec.EllipticCurvePrivateKey | Ed25519PrivateKey | rsa.RSAPrivateKey, export_password: str
+) -> None:
+    pubkey = key.public_key()
+    pubkey_format = pubkey.public_bytes(encoding=Encoding.OpenSSH, format=PublicFormat.OpenSSH)
+    privkey_format_pkcs8 = key.private_bytes(
+        encoding=Encoding.PEM,
+        format=PrivateFormat.PKCS8,
+        encryption_algorithm=BestAvailableEncryption(export_password.encode()),
+    )
+    privkey_format_openssh = key.private_bytes(
+        encoding=Encoding.PEM,
+        format=PrivateFormat.OpenSSH,
+        encryption_algorithm=BestAvailableEncryption(export_password.encode()),
+    )
+    print(f" PGP Private Key {pgp_key.fingerprint} {pgp_key.key_algorithm.name} {pgp_key.key_size!s} ".center(120, "#"))
+    print(f"# SSH Pubkey:\n{pubkey_format.decode('ascii')}\n")
+    print("# PKCS8 Private Key:")
+    print(privkey_format_pkcs8.decode("ascii"))
+    print("# OpenSSH Private Key:")
+    print(privkey_format_openssh.decode("ascii"))
+    print("#" * 120)
+
+
+def _transform_ecdsa(privkey: pgpy.PGPKey) -> ec.EllipticCurvePrivateKey:
+    keymaterial = privkey.__key__
+    return ec.derive_private_key(keymaterial.s, keymaterial.oid.curve())
+
+
+def _transform_ed25519(privkey: pgpy.PGPKey) -> Ed25519PrivateKey:
+    keymaterial = privkey.__key__
+    return Ed25519PrivateKey.from_private_bytes(keymaterial.p.x)
+
+
+def _transform_rsa(privkey: pgpy.PGPKey) -> rsa.RSAPrivateKey:
+    keymaterial = privkey.__key__
+    dmp1 = rsa.rsa_crt_dmp1(keymaterial.d, keymaterial.p)
+    dmq1 = rsa.rsa_crt_dmq1(keymaterial.d, keymaterial.q)
+    iqmp = rsa.rsa_crt_iqmp(keymaterial.p, keymaterial.q)
+    public_numbers = rsa.RSAPublicNumbers(e=keymaterial.e, n=keymaterial.n)
+    privkey_numbers = rsa.RSAPrivateNumbers(
+        p=keymaterial.p,
+        q=keymaterial.q,
+        d=keymaterial.d,
+        dmp1=dmp1,
+        dmq1=dmq1,
+        iqmp=iqmp,
+        public_numbers=public_numbers,
+    )
+    return privkey_numbers.private_key()
+
+
+def parse_subkeys(privkey: pgpy.PGPKey, export_password: str) -> None:
+    for k in privkey.subkeys.values():
+        for sig in k.self_signatures:
+            if KeyFlags.Authentication in sig.key_flags:
+                if k.key_algorithm == pgpy.constants.PubKeyAlgorithm.ECDSA:
+                    output_ssh_key(k, _transform_ecdsa(k), export_password)
+                elif (
+                    k.key_algorithm == pgpy.constants.PubKeyAlgorithm.EdDSA
+                    and k.key_size == pgpy.constants.EllipticCurveOID.Ed25519
+                ):
+                    output_ssh_key(k, _transform_ed25519(k), export_password)
+                elif k.key_algorithm in [
+                    pgpy.constants.PubKeyAlgorithm.RSAEncryptOrSign,
+                    pgpy.constants.PubKeyAlgorithm.RSAEncrypt,
+                    pgpy.constants.PubKeyAlgorithm.RSASign,
+                ]:
+                    output_ssh_key(k, _transform_rsa(k), export_password)
+
+
+@cli.command()
+@click.argument("pgp-key", type=click.File("rb"))
+@click.option(
+    "--export-password",
+    prompt=True,
+    hide_input=True,
+    confirmation_prompt=True,
+    envvar="EXPORT_PASSWORD",
+    help="Password for the exported SSL/SSH private key.",
+    show_envvar=True,
+)
+@click.option(
+    "--import-password",
+    prompt=True,
+    hide_input=True,
+    confirmation_prompt=True,
+    envvar="IMPORT_PASSWORD",
+    help="Password for the imported PGP key.",
+    show_envvar=True,
+)
+def transform(pgp_key: IO, export_password: str, import_password: str) -> None:
+    """
+    Transforms an OpenPGP key to OpenSSL / OpenSSH
+
+    To provide an OpenPGP key, use `gpg --export-ssh-key <keyid>`.
+
+    This tool will extract all subkeys with the "Authentication" flag set.
+    """
+    keyblob = pgp_key.read()
+    try:
+        privkey, _ = pgpy.PGPKey.from_blob(keyblob)
+    except ValueError:
+        msg = "Input is not a valid PGP key"
+        raise TransformError(msg) from None
+    if privkey.is_public:
+        msg = "Input needs to be a private key"
+        raise TransformError(msg)
+    if privkey.is_protected:
+        if not import_password:
+            import_password = click.prompt("PGP Key Password", hide_input=True)
+        with privkey.unlock(import_password):
+            parse_subkeys(privkey, export_password)
+    else:
+        parse_subkeys(privkey, export_password)
+
+
+if __name__ == "__main__":
+    cli()

key_transform-1.0.1.dist-info/METADATA

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: key-transform
+Version: 1.0.1
+Summary: Transforms an OpenPGP private key to OpenSSL / OpenSSH format
+Project-URL: homepage, https://gitlab.com/sebastianw/key-transform/
+Project-URL: repository, https://gitlab.com/sebastianw/key-transform/
+Author-email: Sebastian Wiesinger <sebastian@karotte.org>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet
+Classifier: Topic :: Security
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Utilities
+Requires-Python: >=3.13
+Requires-Dist: bcrypt>=5
+Requires-Dist: click>=8.3.1
+Requires-Dist: cryptography>=46.0.4
+Requires-Dist: pgpy13>=0.6.1rc1; python_full_version >= '3.13'
+Requires-Dist: pgpy; python_full_version < '3.13'
+Description-Content-Type: text/markdown
+
+key-transform
+=============
+
+Transforms an OpenPGP key to PKCS#8 and OpenSSH key format.
+
+Supports RSA, ECDSA and ED25519 keys.
+
+## Installation
+
+Install via pipx or uv tool
+
+```shell
+uv tool install key-transform
+# OR
+pipx install key-transform
+```
+
+## Usage
+
+```shell
+# Lookup secret key(s) and note key fingerprint
+gpg -K
+~/.gnupg/pubring.kbx
+-------------------------------------------------------------
+sec   ed25519 2026-02-06 [SC]
+      972ACF51A09C0259060CFA035432496985998071
+uid           [ultimate] Test Key <test@example.com>
+ssb   cv25519 2026-02-06 [E]
+ssb   rsa3072 2026-02-06 [A]
+ssb   ed25519 2026-02-06 [A]
+ssb   nistp256 2026-02-06 [A]
+
+# Export the key
+gpg --export-secret-key 972ACF51A09C0259060CFA035432496985998071 > secret_key.gpg
+
+# Transform the key, output will be PKCS#8 and OpenSSH format
+key-transform transform secret_key.gpg
+
+#################### PGP Private Key 3F745041AAFE4699CB6FB57F3E311D69E96ADFDD RSAEncryptOrSign 3072 ####################
+# SSH Pubkey:
+ssh-rsa AAAAB3NzaC1yc2[...]
+
+# PKCS8 Private Key:
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIHdTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQmv1ATOwwehUv7yd6
+[...]
+Nu6faDf4tiJQCfrBP0OL8Rt4yJTSHk79IZe8tysYfYVc01jl119v3Cc=
+-----END ENCRYPTED PRIVATE KEY-----
+
+# OpenSSH Private Key:
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABC4U2kyj10gkOYW
+[...]
+OxarmihrTQIcdQpD0Ts1NrV9A/eg3Pua+FRmuVVzfY+fT8bP5+ztIQ5SDmcxmDwNLGDY5vD6jcR0
+q2Sf5Fl7k1uKj1QmPA==
+-----END OPENSSH PRIVATE KEY-----
+
+########################################################################################################################
+############### PGP Private Key 82080A5C69729B254E767F10030959F32C2268B7 EdDSA EllipticCurveOID.Ed25519 ################
+# SSH Pubkey:
+ssh-ed25519 AAAAC3Nza[...]
+
+# PKCS8 Private Key:
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIGjMF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBB+N0mJLilE1jtYvYNO
+[...]
+FmvKKIRiopWgsjUIgcPLRyoDWLdzKg==
+-----END ENCRYPTED PRIVATE KEY-----
+
+# OpenSSH Private Key:
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCUuri5leG0RFKe
+[...]
+K5+JAItSAMQnM9LV5g4PT6nn56VtsSaM3dF+PM0lSoeJDNkR/6pZ7LLyphCwKQ==
+-----END OPENSSH PRIVATE KEY-----
+
+########################################################################################################################
+############## PGP Private Key 963E77E42934A3BD5EDB2139527CD0C853415507 ECDSA EllipticCurveOID.NIST_P256 ###############
+# SSH Pubkey:
+ecdsa-sha2-nistp256 AAAAE2VjZH[...]
+
+# PKCS8 Private Key:
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIH0MF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBA1GnMpIItB3JYv51b9
+[...]
+PZn5p3E77Q==
+-----END ENCRYPTED PRIVATE KEY-----
+
+# OpenSSH Private Key:
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCqT2tcZRsyufkT
+[...]
+bg==
+-----END OPENSSH PRIVATE KEY-----
+
+########################################################################################################################
+```

key_transform-1.0.1.dist-info/RECORD

@@ -0,0 +1,7 @@
+key_transform/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+key_transform/main.py,sha256=HX7AkRJhpi6WIt4Z_0DZKsoKheknZMyAzKNjfUmyKYI,4968
+key_transform-1.0.1.dist-info/METADATA,sha256=WcLRz4IP2eHVsnt66kczyE8Jvfw8U4uCHLJoosMMRtU,4088
+key_transform-1.0.1.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+key_transform-1.0.1.dist-info/entry_points.txt,sha256=sBhPmyqY8B18-0iMYmLozSgLHLvqrWQaSEyNWnjmFQs,57
+key_transform-1.0.1.dist-info/licenses/LICENSE,sha256=cehVwANM7Ib8EuzpNsuOndhL5EHMFma2YyUKjkSBrhM,1076
+key_transform-1.0.1.dist-info/RECORD,,

key_transform-1.0.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.28.0
+Root-Is-Purelib: true
+Tag: py3-none-any

key_transform-1.0.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+key-transform = key_transform.main:cli

key_transform-1.0.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Sebastian Wiesinger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.