Currently it's only compatible with https://github.com/str4d/rage, because age only supports plugins in a branch, but I'm hoping to land support this week!
Currently it's only compatible with https://github.com/str4d/rage, because age only supports plugins in a branch, but I'm hoping to land support this week!
This is definitely something I will look at. One problem is that I use Unix Pass ( https://www.passwordstore.org/ ), which uses GPG under the hood. Through that I use the yubikeys as the actual encryption source for each password, I have each password encrypted against multiple keys to safeguard against loss.
So what would be needed for me to completely move over to age, would be a version of 'pass' that supports age with yubikeys, and also a mobile app that can do this (right now I use PasswordStore on Android, which communicates with OpenKeyChain which is basically GPG for Android with a nice shell around it). So I use the Yubikey over NFC there (though USB is also possible if you really want), to access my passwords. It works pretty well after some initial hiccups.
Besides this I GPG for asymmetric-based file encryption of things like backups, for which age could already be an alternative indeed. And for SSH access, but I kinda had Fido2 pegged as a replacement for that as this is where they're seeming to be headed.
The age plugin system and its currently-specified IPC [0] focuses on easy interoperability via plugin discovery in the PATH. This works very well for native desktop applications (and even between e.g. a Windows host and WSL guest [1]), but obviously not for web or mobile. I'm not optimistic about dynamic plugin discovery ever being feasible for web, but in theory alternate plugin-discovery mechanisms could be figured out for mobile (e.g. Android Intents).
Fortunately, the age plugin system is _also_ a relatively thin wrapper around the core age concepts of Recipients and Identities, so it's possible to write code for an age plugin that can also be used directly as a library! I haven't tried this with age-plugin-yubikey yet specifically, but it should be possible (after some refactoring) to produce a library that can be used to statically include support for YubiKeys directly in an age mobile app, backed by whatever Android library is currently used to provide YubiKey PIV access.
[0] https://github.com/C2SP/C2SP/pull/5
[1] https://github.com/str4d/age-plugin-yubikey#windows-subsyste...
That's exactly the use case I set out to replace for myself. I'll put together a guide at some point. The part I don't use and so can't really own is the mobile app, I would love a community solution there.
I am also planning to integrate https://github.com/FiloSottile/yubikey-agent which makes the SSH authentication part very easy, so that you only type your PIN once and it stays cached.
Thank you for considering this usecase which I personally find very important (though I know it's kinda a niche all things considered!).