YubiKey plugin for age clients
age-plugin-yubikey is a plugin for age clients like age and rage, which enables files to be encrypted to age identities stored on YubiKeys.
Installation
| Environment | CLI command | |-------------|-------------| | Cargo (Rust 1.70+) | cargo install age-plugin-yubikey | | Homebrew (macOS or Linux) | brew install age-plugin-yubikey | | Arch Linux | pacman -S age-plugin-yubikey | | Debian | Debian package | | NixOS | Add to config:<brenvironment.systemPackages = [<br pkgs.age-plugin-yubikey<br];<brOr run nix-env -i age-plugin-yubikey | | Ubuntu 20.04+ | Debian package | | OpenBSD | pkgadd age-plugin-yubikey (security/age-plugin-yubikey) |
On Windows, Linux, and macOS, you can use the pre-built binaries.
Help from new packagers is very welcome.
Linux, BSD, etc.
On non-Windows, non-macOS systems, you need to ensure that the pcscd service is installed and running.
| Environment | CLI command | |-------------|-------------| | Debian or Ubuntu | sudo apt-get install pcscd | | Fedora | sudo dnf install pcsc-lite | | OpenBSD | As root do:<brpkgadd pcsc-lite ccid<brrcctl enable pcscd<brrcctl start pcscd | | FreeBSD | As root do:<brpkg install pcsc-lite libccid<brservice pcscd enable<brservice pcscd start | | Arch | sudo pacman -S pcsclite pcsc-tools yubikey-manager<brsudo systemctl enable pcscd<brsudo systemctl start pcscd|
When installing via Cargo, you also need to ensure that the development headers for the pcsc-lite library are available, so that the pcsc-sys crate can be compiled.
| Environment | CLI command | |-------------|-------------| | Debian or Ubuntu | sudo apt-get install libpcsclite-dev | | Fedora | sudo dnf install pcsc-lite-devel |
Windows Subsystem for Linux (WSL)
WSL does not currently provide native support for USB devices. However, Windows binaries installed on the host can be run from inside a WSL environment. This means that you can encrypt or decrypt files inside a WSL environment with a YubiKey:
- Install age-plugin-yubikey on the Windows host.
- Install an age client inside the WSL environment.
- Ensure that age-plugin-yubikey.exe is available in the WSL environment's
PATH. For default WSL setups, the Windows host's PATH is automatically added to the WSL environment's PATH (see this Microsoft blog post for more details).
Configuration
age-plugin-yubikey identities have two parts:
- The secret key material, which is stored inside a YubiKey.
- An age identity file, which contains information that an age client can use to