Support for age-plugin-yubikey

[TheWanderer1983]

Any chance you could add support?

Regards
Dylan

[biox]

i don't have a personal need for it, so i'm unlikely to add support - but if you could come up with an initial implementation, i might be willing to help you hammer it out.

[arcxio]

i've been meaning to play around with yubikey, just haven't got around to it yet, but if i understand it correctly, you generate an identity with it and then use it as usual with age.
since pa identities are out in the open in your ~/.local/share/pa/identities file, if you output an identity generated with age-plugin-yubikey to that file, your pa will be connected with your yubikey and all should work well.
the only thing i guess we could streamline here is that our identity autogeneration could pick up if you have age-plugin-yubikey installed and act accordingly.

[biox]

oh interesting, maybe i'll play with this today after work, i didn't realize it might be so trivial - i have a few spare yubikeys laying around

[TheWanderer1983]

On Wed Dec 11, 2024 at 1:50 AM AEDT, j3s wrote: oh interesting, maybe i'll play with this today after work, i didn't realize it might be so trivial - i have a few spare yubikeys laying around

age-plugin-yubikey identities have two parts: The secret key material, which is stored inside a YubiKey. An age identity file, which contains information that an age client can use to figure out which YubiKey secret key should be used.

[biox]

i tested this out today, and pa seems to support everything with no changes, as @arcxio expected.

steps (i used arch, but the steps should be basically agnostic):

# enter a new PA_DIR
export PA_DIR=/tmp/yubikey-test
cd /tmp/yubikey-test

# install deps
sudo pacman -S age-yubikey-plugin pcsclite ccid

# walk through the very good tutorial for making an identity
age-yubikey-plugin

# save your identity
age-plugin-yubikey -i > identities

# save your recipients
age-plugin-yubikey -l > recipients

tah dah! everything works as usual - pa add/edit/list/etc all work just fine.

i can think of a few UX improvements that maaaaybe pa could help with:

• some sort of prompt for knowing when to touch the yubikey? it lights up though, which seems rather "prompty"
• if we detect the plugin, maybe we offer to write out the recipient/identityfile on behalf of the user

i think that's about it? honestly works pretty good, i might start doing it this way lmao.

[arcxio]

• some sort of prompt for knowing when to touch the yubikey?

i'd say this is out of scope for us and better handled by dedicated software like maximbaz/yubikey-touch-detector

if we detect the plugin, maybe we offer to write out the recipient/identityfile on behalf of the user

this would be nice

[biox]

had some time to whip this together, thoughts? #52

[arcxio]

maximbaz/yubikey-touch-detector

apparently this one doesn't work right now with age plugin because max-baz/yubikey-touch-detector#22

but still I don't think there is a good reason to work around that in pa