-
Notifications
You must be signed in to change notification settings - Fork 855
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Age malformed recipient - invalid type "age1yubikey" #1103
Comments
Have the same problem, latest version of sops (v3.7.3) and age (v1.0.0). This probably requires to include age v1.1.0, as only there was included the plugin mechanism required for the age-plugin-yubikey. |
I have the same problem using latest versions of sops and age. |
I have the same problem even when doing a sops |
Age got a v1.1.1 release a few days ago. Now it isn't a release candidate anymore. |
A bump to the latest age release makes 100% sense but I did a make build with the newest version specified as the age dependency but still experienced this issue. Seems that something in the sops code needs to change to enable on-yubikey encryption keys still. |
check your age version. Maybe the brew wasnt updated already. |
Yes, running |
Just dropping in to confirm that this issue still exists with age |
Still getting the same issue when trying to encrypt with a yubikey-based age identity. In my environment Regardless of whether I use the brew installed version of sops (v3.7.3) or I build it from source (first updating the vendored age go module dependency to v1.1.1), I get the original OP's error on encryption operations. And, if I use a non-yubikey-based age identity everything works fine. The yubikey-based age public key (aka receipient) is of the form: 'age1yubikey'. This is a different format to that of a regular public age key which is of the form: 'age'. |
However it should be noted this is with
from here Ive started a discussion upstream here if anyone has anything to add or wants to follow |
Quick summary here. I outright stole the code from parse.go and moved the plugin out of internal to test it locally to confirm it works with just code from these 2 files. If its not clear, I am not recommending this experiment. Just noting it does work and as hacky as it is, itsn't terribly hard to enable once you know where everything is. So it will likely be trivial once the api is finalized and exposed. Hardest part is probably deciding how to handle pin input and prompts. terminal? pinentry? Is SOPS_AGE_PIN env variable a terrible idea to support? |
Not sure if I find time to try this myself anytime soon, but as sops pgp backend supports both, using |
Getting inspiration from FiloSottile/age#86 (comment), this is how you can approximate using yubikey-stored age key with sops today: The idea is to create an age key, but store it encrypted, where the encryption key is the yubikey-stored age key. Then when invoking sops, decrypt the stored key on the fly using the yubikey. I think this is less secure than using the yubikey-age-key directly, but better than nothing (as long as you don't store the decrypted key anywhere just pass to sops). Edit: Elaboration on why this is not entirely like a yubikey-stored key: if the host is compromised, an attacker can intercept the (temporarily) decrypted age key and steal it, performing further decrypts (or even encrypts) with it in the future. If the decompression of the sops-protected secret were done using a fully yubikey-stored age key, then the attacker can only steal the decompressed secret values, but not the key itself. So "only" the current set of secrets is compromised, but not the key itself. Demonstration:
|
Hello!
I'm using Age with Yubikey. Support for plugins was recently added to Age v1.1.0-rc.1 repository, but the validation still fails in SOPS.
Looks like the validation for identity fails because the parse-method of Age was never updated outside of Cmd...
Please look into adding support using Age with Yubikey, the plugin I'm using is this: https://github.com/str4d/age-plugin-yubikey
The commits inAge repo that adds plugin functionality : FiloSottile/age@cff70cf...87a982b
Example error:
The text was updated successfully, but these errors were encountered: