UX: interaction with yubikey-agent #136
Comments
To clarify, you mean you were using (EDIT: I see you're one of the users who commented on #115 so I'm guessing you are working from the
This is unfortunately unavoidable for
If you're solely using However, there is nothing I can do about the git / age interaction in |
FWIW I'm not signing commits with gpg anymore
I'm on nixos and pretty sure I've killed gpg and all the other ssh agents except yubikey-agent. Sometimes the behavior I see is this:
There's no other interactions to the key between the two attempts. I haven't had time to debug this in detail and narrow down when/what exactly happens for the pin to clear. |
|
There's not much I can do to figure out improvements without having further details. In particular, I'd need the YubiKey version, and output from decrypting with That still might not be sufficient to figure this out though; we might actually need a full trace of the traffic going to the YubiKey from all sources including other apps. All it takes is one other app on your system to connect to the YubiKey (just to discover that it exists, not even to use it - this was one of the bugs I had to fix in In the meantime, I'm not going to block the 0.4.0 release on this issue, as AFAICT the PIN caching behaviour is working pretty well for most people and most use cases. |
|
I'll have time this week to dig in and get to the bottom of this.
One thing I'm doing that might be different from the rest is I'm reading the identity off of the key every time (instead of storing it into a file somewhere). This is my decrypt invocation: Tried running age-plugin-yubikey with RUST_LOG=trace but got no extra output. Do I need to compile a dev binary for this? EDIT: age-plugin-yubikey 0.4.0 from nixpkgs |
To confirm, this is with an identity that has PIN policy "Once" and touch policy "Always"? And behaving as you intend?
Okay, that is very different to what I'd been expecting! And this combined with the other parts of your observation gives a hint as to where we should be looking:
This suggests that
This suggests that It would be useful to determine whether the cache is being cleared by the decryption, or the identity generation.
You'd need to provide that as an environment variable to |
|
🤦♂️ looking back at my own snippet, turns out RUST_LOG=trace works better if you don't send What you wrote makes sense and seems like
Yep left that here for posterity, but to elaborate fully: that behaviour is expected and set by default by yubikey-agent. Here's a RUST_LOG=trace enabled log of 2 actions (encrypt and decrypt), both prompted me for PIN. |
|
@str4d Ping on this one :)
Side question: is there a better way of handling multiple yubikeys at different workstations? |
|
Update: I've tried caching the key grip to a file, hoping that it will resolve the pin being requested too often. # Contents of `age-decrypt`
# Usage:
# $ age-decrypt file.age
# $ pbpaste | age-decrypt
ykid=/tmp/yubi-id
test -f $ykid || age-plugin-yubikey --identity --slot 1 > $ykid 2>/dev/null
age -i $ykid -d "$@"@str4d is there any considerations / plans to revisit the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
From README:
After using yubikey-agent and yubikey-agent-plugin for ~a month exclusively (completely switched ssh, age and pgp keys to yubi+age) I think the UX is not as good as it could be.
My workflow consists of frequent ssh, git and age usage and every time I ssh/git, the pin cache gets invalidated.
There is one potential downside of interacting with yubikey-agent: it's pinentry logic only supports GUI programs as opposed to age-plugin-yubikey which supports tty. Would prefer if tty was supported for both.
All in all, as much as I appreciate the modular design, think age, yubikey-agent and age-plugin-yubikey should be integrated a bit more seamlessly.
The text was updated successfully, but these errors were encountered: