This repository has no description
keys: add YubiKey (yubi1) age and SSH keys
- Add yubi1 age public key generated with age-plugin-yubikey
- Add yubi1 SSH ed25519-sk public key
- Store SSH private key encrypted with age
- Update ssh-with-age to support age-plugin-yubikey decryption
- Tool now supports Solo 2, Secure Enclave, and YubiKey devices
author
lassulus
date
(Jun 28, 2025, 1:45 AM CEST)
commit
c307d8b6
c307d8b62a3f7040bb6a8e52ab45a8d8c81ddbde
parent
d29e7cf0
d29e7cf0b294b3b7f9e0b735719dd9e3cc8d7f5a
+10
-8
+1
keys/age/yubi1.age
+1
keys/age/yubi1.age
···
1
+
age1yubikey1q2jt8g46xn2uj723zlygp35raccdkwdfu49hjjcs3sjm2gn0egvyynmaqv9
keys/ssh/yubi1.age
keys/ssh/yubi1.age
This is a binary file and will not be displayed.
+1
keys/ssh/yubi1.pub
+1
keys/ssh/yubi1.pub
···
1
+
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAID05m+EeVBhjdi8HNnz2aFxc6ebWulFhQkvQzcXoCgTWAAAABHNzaDo= lassulus@yubi1
+8
-8
tools/ssh-with-age/flake-module.nix
+8
-8
tools/ssh-with-age/flake-module.nix
···
25
25
pkgs.openssh
26
26
pkgs.age
27
27
pkgs.age-plugin-se
28
+
pkgs.age-plugin-yubikey
28
29
pkgs.libfido2
29
30
];
30
31
text = ''
···
84
85
85
86
echo "Trying key: $key_name..."
86
87
87
-
# Try to decrypt with repository age keys
88
+
# Try to decrypt with hardware plugins
88
89
decrypted=false
89
-
for age_key in ${toString (builtins.attrValues self.keys.age)}; do
90
-
if age -d -j fido2-hmac "$encrypted_key" > "$temp_key" 2>/dev/null || \
91
-
age -d -j se "$encrypted_key" > "$temp_key" 2>/dev/null; then
92
-
decrypted=true
93
-
break
94
-
fi
95
-
done
90
+
# Try each hardware plugin method
91
+
if age -d -j fido2-hmac "$encrypted_key" > "$temp_key" 2>/dev/null || \
92
+
age -d -j se "$encrypted_key" > "$temp_key" 2>/dev/null || \
93
+
age -d -j yubikey "$encrypted_key" > "$temp_key" 2>/dev/null; then
94
+
decrypted=true
95
+
fi
96
96
97
97
if [[ "$decrypted" == "true" ]]; then
98
98