4 ms·

Hello! age (https://age-encryption.org https://age-encryption.org) author here. Different tools can definitely be better for different use cases (for example I

Hello! age (https://age-encryption.org https://age-encryption.org) author here. Different tools can definitely be better for different use cases (for example I am a fan of restic [0] for backups, although age is designed to compose well with tar, if that's your thing), but do you mind me asking what made that tool feel more well defined than age? age has a stable spec [1] and an alternative implementation in Rust [2] based on the spec with extensive interop tests. If that’s just not visible, I’d be interested in how to fix that appearance, too! [0]: https://words.filippo.io/restic-cryptography/ https://words.filippo.io/restic-cryptography/ [1]: https://age-encryption.org/v1 https://age-encryption.org/v1 [2]: https://github.com/str4d/rage https://github.com/str4d/rage

e12e 4y ago
I may have been too quick to judge - I first thought sigtool was a superset of openbsd signify - not a work-a-like. And it appeared sigtool's approach with probuf was somewhat sturdier than a custom spec/format (although the age spec does look quite nice and straightforward). Additionally, I came across some comments on age's custom primitives - but I suppose that's also similar for the two. Ed: thank you for your work on age!
GekkePrutser 4y ago
Are you planning to support hardware encryption tokens also like GPG does with OpenPGP cards? For me this is an absolute must-have in order to even consider age as an alternative for GPG/PGP. GPG's codebase is not great indeed, but in this case it's not super important as the key generation happens inside the actual token anyway.
- FiloSottile 4y ago
  Yes! That’s what the plugin system is designed for. https://github.com/str4d/age-plugin-yubikey https://github.com/str4d/age-plugin-yubikey is fairly mature and I use it every day. Currently it's only compatible with https://github.com/str4d/rage https://github.com/str4d/rage, because age only supports plugins in a branch, but I'm hoping to land support this week!
  - GekkePrutser 4y ago
    Interesting, when I looked at it a couple years ago I didn't see that. So it uses the PIV mode? And it can use asymmetric encryption as I see it? This is definitely something I will look at. One problem is that I use Unix Pass ( https://www.passwordstore.org/ https://www.passwordstore.org/ ), which uses GPG under the hood. Through that I use the yubikeys as the actual encryption source for each password, I have each password encrypted against multiple keys to safeguard against loss. So what would be needed for me to completely move over to age, would be a version of 'pass' that supports age with yubikeys, and also a mobile app that can do this (right now I use PasswordStore on Android, which communicates with OpenKeyChain which is basically GPG for Android with a nice shell around it). So I use the Yubikey over NFC there (though USB is also possible if you really want), to access my passwords. It works pretty well after some initial hiccups. Besides this I GPG for asymmetric-based file encryption of things like backups, for which age could already be an alternative indeed. And for SSH access, but I kinda had Fido2 pegged as a replacement for that as this is where they're seeming to be headed.
    - FiloSottile 4y ago
      https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage :) That's exactly the use case I set out to replace for myself. I'll put together a guide at some point. The part I don't use and so can't really own is the mobile app, I would love a community solution there. I am also planning to integrate https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent which makes the SSH authentication part very easy, so that you only type your PIN once and it stays cached.
      - GekkePrutser 4y ago
        This looks great, thanks! Yeah it will need a community solution, the one on Android for pass/gpg is also not from the original makers of either! It actually took a long time for this toolchain to materialise on Android too. Thank you for considering this usecase which I personally find very important (though I know it's kinda a niche all things considered!).
    - 4y ago

e12e 4y ago

I may have been too quick to judge - I first thought sigtool was a superset of openbsd signify - not a work-a-like. And it appeared sigtool's approach with probuf was somewhat sturdier than a custom spec/format (although the age spec does look quite nice and straightforward). Additionally, I came across some comments on age's custom primitives - but I suppose that's also similar for the two. Ed: thank you for your work on age!

GekkePrutser 4y ago

Are you planning to support hardware encryption tokens also like GPG does with OpenPGP cards? For me this is an absolute must-have in order to even consider age as an alternative for GPG/PGP. GPG's codebase is not great indeed, but in this case it's not super important as the key generation happens inside the actual token anyway.

FiloSottile 4y ago
Yes! That’s what the plugin system is designed for. https://github.com/str4d/age-plugin-yubikey https://github.com/str4d/age-plugin-yubikey is fairly mature and I use it every day. Currently it's only compatible with https://github.com/str4d/rage https://github.com/str4d/rage, because age only supports plugins in a branch, but I'm hoping to land support this week!
- GekkePrutser 4y ago
  Interesting, when I looked at it a couple years ago I didn't see that. So it uses the PIV mode? And it can use asymmetric encryption as I see it? This is definitely something I will look at. One problem is that I use Unix Pass ( https://www.passwordstore.org/ https://www.passwordstore.org/ ), which uses GPG under the hood. Through that I use the yubikeys as the actual encryption source for each password, I have each password encrypted against multiple keys to safeguard against loss. So what would be needed for me to completely move over to age, would be a version of 'pass' that supports age with yubikeys, and also a mobile app that can do this (right now I use PasswordStore on Android, which communicates with OpenKeyChain which is basically GPG for Android with a nice shell around it). So I use the Yubikey over NFC there (though USB is also possible if you really want), to access my passwords. It works pretty well after some initial hiccups. Besides this I GPG for asymmetric-based file encryption of things like backups, for which age could already be an alternative indeed. And for SSH access, but I kinda had Fido2 pegged as a replacement for that as this is where they're seeming to be headed.
  - FiloSottile 4y ago
    https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage :) That's exactly the use case I set out to replace for myself. I'll put together a guide at some point. The part I don't use and so can't really own is the mobile app, I would love a community solution there. I am also planning to integrate https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent which makes the SSH authentication part very easy, so that you only type your PIN once and it stays cached.
    - GekkePrutser 4y ago
      This looks great, thanks! Yeah it will need a community solution, the one on Android for pass/gpg is also not from the original makers of either! It actually took a long time for this toolchain to materialise on Android too. Thank you for considering this usecase which I personally find very important (though I know it's kinda a niche all things considered!).
  - 4y ago