support of ssh-agent

[jfcoz]

Could it be possible, when using SSH keys, to rely on ssh-agent for already loaded keys with their passphrases ?

Thanks

[iosmanthus]

A standard SSH agent cannot do this. The SSH key encryption process converts an Ed25519 key to X25519 and then performs HPKE. This process requires direct access to the private key. However, an SSH agent only provides signing capabilities, which others can verify using the public key. What you need instead is a decrypt/encrypt oracle. The discussion might help FiloSottile/age#244.

[felixfontein]

Since SSH agents only seem to allow signing, but not encrypting/decrypting, I don't think this is something we can support.

(Ref: https://www.ietf.org/archive/id/draft-ietf-sshm-ssh-agent-16.html, in particular Section 3.6.)