age-plugin-fido -- draft fido plugin for age(1)

• WARNING: early draft, likely buggy, protocol not finalized
• WARNING: useful only for symmetric encryption to self
• WARNING: works only with fido2 keys using hmac-secret
• WARNING: does not work with u2f-only keys
• WARNING: look behind you, a three-headed monkey!
• WARNING: usability issues with multiple fido keys
• WARNING: not actually tested with age(1) yet

Plugin specification: https://hackmd.io/@str4d/age-plugin-spec

Example

Generate an identity:

   $ ./age-plugin-fido
# tap fido2 device
<  age1fido1yvzqylncrhhrnw8sz64shsg34jdeeths2h70kfw7hqqgznf26ke55y972xws6v74cdy2twsjss77g2xzwfkweejasgfkny6qe2fm64q0aqv5p
<  AGE-PLUGIN-FIDO-1YVZQYLNCRHHRNW8SZ64SHSG34JDEETHS2H70KFW7HQQGZNF26KE55Y972XWS6V74CDY2TWSJSS77G2XZWFKWEEJASGFKNY6QE2FM64QGMZC3C

Encapsulate a key:

   $ ./age-plugin-fido --age-plugin=recipient-v1
>  -> add-recipient age1fido1yvzqylncrhhrnw8sz64shsg34jdeeths2h70kfw7hqqgznf26ke55y972xws6v74cdy2twsjss77g2xzwfkweejasgfkny6qe2fm64q0aqv5p
>  -> wrap-file-key
>  4bgH0XAZjfFoWzu9kPEc1X3LLDtrJhqsVzKbrdpfFtw=
>  -> done
# tap fido2 device
<  -> recipient-stanza 0 fido 7bupApLfkhzCgdmpgM6PcC1uDEIm3QZeSVjg2rgE3Ck= wx3Sr82kfmOQttx7ND7ic2uCpmxrA5Es6s+GUb9uAfM=
<  DiI1KqY+rLlliM0dUBPWwjJtBNWC2k9V3hFheWZ2izI2wPP/q1mvftAhsixI6zPY
<  dPjOM5s812VOgccOjJl51g==
<  -> done

Decapsulate the key:

   $ ./age-plugin-fido --age-plugin=identity-v1
>  -> add-identity AGE-PLUGIN-FIDO-1YVZQYLNCRHHRNW8SZ64SHSG34JDEETHS2H70KFW7HQQGZNF26KE55Y972XWS6V74CDY2TWSJSS77G2XZWFKWEEJASGFKNY6QE2FM64QGMZC3C
>  -> recipient-stanza 0 fido 7bupApLfkhzCgdmpgM6PcC1uDEIm3QZeSVjg2rgE3Ck= wx3Sr82kfmOQttx7ND7ic2uCpmxrA5Es6s+GUb9uAfM=
>  DiI1KqY+rLlliM0dUBPWwjJtBNWC2k9V3hFheWZ2izI2wPP/q1mvftAhsixI6zPY
>  dPjOM5s812VOgccOjJl51g==
>  -> done
# tap fido2 device
<  -> file-key 0
<  4bgH0XAZjfFoWzu9kPEc1X3LLDtrJhqsVzKbrdpfFtw=
<  -> done

Format

Identity and recipient share the same payload, a FIDO2 credential id created with relying party id x-age://fido. Identity is encoded with bech32 human-readable part AGE-PLUGIN-FIDO-, and recipient is encoded with age1fido.

Recipient stanza has form:

fido <base64-credhash> <base64-salt>
<base64-ciphertext>

• <base64-credhash> is the whitespace-free base64 encoding of the SHA-256 hash of:

  • AGEFIDO1 (US-ASCII text)
  • the 2-byte big-endian encoding of the number of bytes in the credential id
  • the credential id

• <base64-salt> is the whitespace-free base64 encoding of a 32-byte salt chosen independently uniformly at random for each wrapped key

• <base64-ciphertext> is the line-folded base64 encoding of the ChaCha20-HMACSHA256-SIV ciphertext wrapping a key, with the credential id as associated data, under HMAC secret key obtained from the device with the given credential id and salt

The identity and recipient store the same information, the credential id -- there is no private/public separation of powers.