ed25519-to-age

Derive an age key from an SSH Ed25519 key held by ssh-agent.

The default output is the public age recipient. Use --secret to print the secret age identity.

Install

cargo install --path .

Usage

ed25519-to-age [OPTIONS]

Examples:

ed25519-to-age
ed25519-to-age --variant work
ed25519-to-age --secret
ed25519-to-age --variant sops --secret
ed25519-to-age --key-file ~/.ssh/id_ed25519.pub
ed25519-to-age --public-key "$(cat ~/.ssh/id_ed25519.pub)"

Options:

• -s, --secret: print the secret age identity
• -v, --variant <NAME>: derived key variant, defaulting to default
• -f, --key-file <PATH>: SSH Ed25519 public key file
• -p, --public-key <KEY>: literal ssh-ed25519 public key
• -h, --help: print help
• -V, --version: print version

Environment:

• ED25519_TO_AGE_VARIANT
• ED25519_TO_AGE_KEY_FILE
• ED25519_TO_AGE_PUBLIC_KEY

Requirements

• OpenSSH with ssh-keygen -Y sign
• SSH_AUTH_SOCK pointing at an agent that can sign with the selected key
• age-keygen

Passphrase-protected SSH keys work once loaded with ssh-add. This tool never reads a private SSH key file.

Notes

• Different variants produce different age keys.
• The variant is not secret.
• Public key comments are ignored.
• --secret output is private key material.