3 ms·

Yes! That’s what the plugin system is designed for. https://github.com/str4d/age-plugin-yubikey https://github.com/str4d/age-plugin-yubikey is fairly mature and

Yes! That’s what the plugin system is designed for. https://github.com/str4d/age-plugin-yubikey https://github.com/str4d/age-plugin-yubikey is fairly mature and I use it every day. Currently it's only compatible with https://github.com/str4d/rage https://github.com/str4d/rage, because age only supports plugins in a branch, but I'm hoping to land support this week!

GekkePrutser 4y ago
Interesting, when I looked at it a couple years ago I didn't see that. So it uses the PIV mode? And it can use asymmetric encryption as I see it? This is definitely something I will look at. One problem is that I use Unix Pass ( https://www.passwordstore.org/ https://www.passwordstore.org/ ), which uses GPG under the hood. Through that I use the yubikeys as the actual encryption source for each password, I have each password encrypted against multiple keys to safeguard against loss. So what would be needed for me to completely move over to age, would be a version of 'pass' that supports age with yubikeys, and also a mobile app that can do this (right now I use PasswordStore on Android, which communicates with OpenKeyChain which is basically GPG for Android with a nice shell around it). So I use the Yubikey over NFC there (though USB is also possible if you really want), to access my passwords. It works pretty well after some initial hiccups. Besides this I GPG for asymmetric-based file encryption of things like backups, for which age could already be an alternative indeed. And for SSH access, but I kinda had Fido2 pegged as a replacement for that as this is where they're seeming to be headed.
- FiloSottile 4y ago
  https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage :) That's exactly the use case I set out to replace for myself. I'll put together a guide at some point. The part I don't use and so can't really own is the mobile app, I would love a community solution there. I am also planning to integrate https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent which makes the SSH authentication part very easy, so that you only type your PIN once and it stays cached.
  - GekkePrutser 4y ago
    This looks great, thanks! Yeah it will need a community solution, the one on Android for pass/gpg is also not from the original makers of either! It actually took a long time for this toolchain to materialise on Android too. Thank you for considering this usecase which I personally find very important (though I know it's kinda a niche all things considered!).
- str4d 4y ago
  > and also a mobile app that can do this (right now I use PasswordStore on Android, which communicates with OpenKeyChain which is basically GPG for Android with a nice shell around it). So I use the Yubikey over NFC there (though USB is also possible if you really want), to access my passwords. It works pretty well after some initial hiccups. The age plugin system and its currently-specified IPC [0] focuses on easy interoperability via plugin discovery in the PATH. This works very well for native desktop applications (and even between e.g. a Windows host and WSL guest [1]), but obviously not for web or mobile. I'm not optimistic about dynamic plugin discovery ever being feasible for web, but in theory alternate plugin-discovery mechanisms could be figured out for mobile (e.g. Android Intents). Fortunately, the age plugin system is _also_ a relatively thin wrapper around the core age concepts of Recipients and Identities, so it's possible to write code for an age plugin that can also be used directly as a library! I haven't tried this with age-plugin-yubikey yet specifically, but it should be possible (after some refactoring) to produce a library that can be used to statically include support for YubiKeys directly in an age mobile app, backed by whatever Android library is currently used to provide YubiKey PIV access. [0] https://github.com/C2SP/C2SP/pull/5 https://github.com/C2SP/C2SP/pull/5 [1] https://github.com/str4d/age-plugin-yubikey#windows-subsystem-for-linux-wsl https://github.com/str4d/age-plugin-yubikey#windows-subsyste...

GekkePrutser 4y ago

Interesting, when I looked at it a couple years ago I didn't see that. So it uses the PIV mode? And it can use asymmetric encryption as I see it? This is definitely something I will look at. One problem is that I use Unix Pass ( https://www.passwordstore.org/ https://www.passwordstore.org/ ), which uses GPG under the hood. Through that I use the yubikeys as the actual encryption source for each password, I have each password encrypted against multiple keys to safeguard against loss. So what would be needed for me to completely move over to age, would be a version of 'pass' that supports age with yubikeys, and also a mobile app that can do this (right now I use PasswordStore on Android, which communicates with OpenKeyChain which is basically GPG for Android with a nice shell around it). So I use the Yubikey over NFC there (though USB is also possible if you really want), to access my passwords. It works pretty well after some initial hiccups. Besides this I GPG for asymmetric-based file encryption of things like backups, for which age could already be an alternative indeed. And for SSH access, but I kinda had Fido2 pegged as a replacement for that as this is where they're seeming to be headed.

FiloSottile 4y ago
https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage :) That's exactly the use case I set out to replace for myself. I'll put together a guide at some point. The part I don't use and so can't really own is the mobile app, I would love a community solution there. I am also planning to integrate https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent which makes the SSH authentication part very easy, so that you only type your PIN once and it stays cached.
- GekkePrutser 4y ago
  This looks great, thanks! Yeah it will need a community solution, the one on Android for pass/gpg is also not from the original makers of either! It actually took a long time for this toolchain to materialise on Android too. Thank you for considering this usecase which I personally find very important (though I know it's kinda a niche all things considered!).
str4d 4y ago
> and also a mobile app that can do this (right now I use PasswordStore on Android, which communicates with OpenKeyChain which is basically GPG for Android with a nice shell around it). So I use the Yubikey over NFC there (though USB is also possible if you really want), to access my passwords. It works pretty well after some initial hiccups. The age plugin system and its currently-specified IPC [0] focuses on easy interoperability via plugin discovery in the PATH. This works very well for native desktop applications (and even between e.g. a Windows host and WSL guest [1]), but obviously not for web or mobile. I'm not optimistic about dynamic plugin discovery ever being feasible for web, but in theory alternate plugin-discovery mechanisms could be figured out for mobile (e.g. Android Intents). Fortunately, the age plugin system is _also_ a relatively thin wrapper around the core age concepts of Recipients and Identities, so it's possible to write code for an age plugin that can also be used directly as a library! I haven't tried this with age-plugin-yubikey yet specifically, but it should be possible (after some refactoring) to produce a library that can be used to statically include support for YubiKeys directly in an age mobile app, backed by whatever Android library is currently used to provide YubiKey PIV access. [0] https://github.com/C2SP/C2SP/pull/5 https://github.com/C2SP/C2SP/pull/5 [1] https://github.com/str4d/age-plugin-yubikey#windows-subsystem-for-linux-wsl https://github.com/str4d/age-plugin-yubikey#windows-subsyste...