Hacker News Reader

Comment by andrewstuart2 | Hacker News Reader

The main thing that I wish age had is a key database for managing contacts. It's awesome that it's modern and secure, but having to manage and refer to my key files (and friends' key files) manually is painful. Not that it matters much; for both tools I have a contact list of effective length zero. At least for PGP, I can sign my commits (and various other artifacts) and use my GNU pass/gopass database.

View on HN

That's interesting, this behavior is one of many reasons why I love age. I don't want a key database for virtually any of my use cases

What I like is that I can generally run `gpg --encrypt --recipient andrew` and it will search keys by a few different "fields" to find matches. I don't need to remember where I put the key file or even always the person's email vs name. Some people I can remember handles more easily than real IDs and that works just fine with the gpg database implementation.

Why not just put your friend's keys in a well known place by their name, like in your home directory? Then you can just refer to them as ~/identities/andrew for example. You could even add a symlink for andrew's email in the same dir.

This also lets you use your shell's tab completion or even a fuzzy finder to list and select identities.

You're definitely right. I can do that. I can also symlink the files to multiple aliases if I want to be able to use multiple possible references for the same key. But I do prefer it when the tool handles that for me.

I'd like age to remain as simple as it is right now, I'm using it because unlike GPG I can actually use it without having to manpage/google things, but that sounds like a great idea for a more capable utility that wraps age for the GPG use cases that aren't covered well yet

GPG key management is very useful, at least for personal use. For instance, it’s unwieldy to copy paste various keys manually in terminal. The latest versions of GPG offer authenticated encryption as well.

But perhaps age is better suited as a backend in other apps, especially Go apps. A good feature of PIV applet of Yubikey 5 is that it stores 24 keys. compared to 3 in OpenPGP (although any app including GPG could make use of those 24 slots).

What I am looking for these days is a back up tool that uses age. Can an app like restic use age as backend?

> A good feature of PIV applet of Yubikey 5 is that it stores 24 keys.

Note that not all 24 of those keys are suitable for age usage. The 4 main keys have specific usage definitions in the PIV specification that mean hardware tokens alter how those key slots behave. Only one of them (the KeyManagement slot) has a definition that allows encryption, and even that I was somewhat suspicious of overlapping with, as I couldn't predict how those existing keys were being used, and didn't want to support every possible key type that might be in that slot (which users likely wouldn't be able to alter).

age-plugin-yubikey avoids this complexity by only interacting with the 20 "retired" slots, which have no constraining definitions. (I am considering adding restricted support for the KeyManagement slot specifically for CAC card users who aren't allowed to add new keys to their cards [0], but this would be behind a default-off feature flag to keep the primary UX simple.)

[0] https://github.com/str4d/age-plugin-yubikey/issues/62

An age key database would be a fundamentally different thing than a PGP keyring. Age doesn't do signatures and as a result can't do authentication for asymmetrical encryption. So an age key database would be just a list of unauthenticated encryption keys. Without the ability to do signatures, that is all it ever could be. So it probably doesn't make sense to bake something like that into the utility.

A PGP keyring is a list of identities. Once you have verified an identity you can not be tricked into using the wrong encryption key for that entity. You can then be sure of the authenticity of any messages/files you get from that entity.

I mean, that's kind of like saying it's fine to have your phone numbers in a text document on your phone, so why bother adding a contacts application, especially since caller ID isn't authenticated.

I get that it's out of scope and wouldn't be that hard at all to implement a wrapper that handles this, but without that functionality I find it much less enticing because I'm left to think about something that the other tool I use handles (and as you've noted, a lot more seriously too).

To be honest I am not really sure what age is useful for. I only know what it is not useful for and that includes anything to do with identity.

Use the DNS: https://www.go350.com/posts/age-file-encryption/#age-pki-iss...

Reply on news.ycombinator.com