FR: Put the same age key on multiple Yubikeys

[orolhawion]

For backup reasons I would like to be able to put an age private key on more than one Yubikey so in case one Yubikey breaks, gets lost, is unusable in some other way, I would have another key that could decrypt my files. I might have overlooked such a feature, if so, please let me know how to do it.

[mihaigalos]

This will list all identities for plugged in YubiKeys:

$ age-plugin-yubikey --identity > identities

You can then encrypt to multiple identities:

$ identities=$(cat identities | grep Recipient | sed -e "s/ //g" | cut -d':' -f2 | sed -e 's/^age\(.*\)/ -r age\1/g'  | tr -d '\n')
$ rage $identities -e input.file -o output.file.age

Then decrypt to a single identitiy (a single plugged in YubiKey):

$ age-plugin-yubikey --identity > identity 2>/dev/null
$ cat $secret_file | rage -d -i identity

Have a look at how I've done it in pass for more details.

[mihaigalos]

BTW: the actual keys stored on the Yubikeys are still different^.

[orolhawion]

ok, so you mean private age keys should be different and I should encrypt to all of them, which in fact makes this topic closable. thanks for the heads up. :)

[Merovius]

I am interested in the same thing for the same reason. I'd prefer having the same secret key on all my YubiKeys, so that if I have to replace one, I don't have to go around re-encrypting everything.

I understand the tradeoffs involved and I understand why people prefer to have separate private keys per hardware token. But I'd like the option to use an offline generated key.

[mihaigalos]

My 2 cents: I understand your point. Not sure if it's technically possible.

I believe a Yubikey-unique part (possibly hardware-coded) is involved in the process of generating an identity.

It is therefore unique and if you lose the Yubikey, you are left with whatever others you used to encrypt.
You will need to decrypt and reeencrypt to the list of Yubis you still possess.

Would like it if somebody could confirm/refute this^.

[orolhawion]

I usually put my gpg identity on two different yubikeys, as stated for backup reasons. So I thought this should be possible with age keys also.

[mihaigalos]

@str4d ?

[kmille]

Another way to achieve this would be by generating the private key on an "unsafe device" and then importing it to the YubiKey(s). Is there a way/tutorial how to import private keys to the Yubikey?

[Merovius]

@kmille It's easy to do that using ykman, but age-plugin-yubikey refuses to use keys which have not been generated on the Yubikey.

[pinpox]

@kmille It's easy to do that using ykman, but age-plugin-yubikey refuses to use keys which have not been generated on the Yubikey.

Is there a technical reason/limitation behind this or could that be changed on age-plugin-yubikey's side? I'm used to the workflow as decribed by @orolhawion and @Merovius from gpg. I have also generated my gpg keys on an airgapped laptop and copied the keys to multiple yubikeys and also printed them out on paper to be stored safely as last-resort backup.

I would love to move from gpg to age for all encrypting purpouses, is there any chance we could allow keys not generated on the yubikey itself and copied via ykman?

This would also solve #3
Also, if you don't want to use this approach or disallow them I guess it could just be configurable whether you want to allow it?

[pinpox]

@mihaigalos I have a key and can help test this but need some guidance. How do you generate a key in the correct format to be imported? @Merovius how did you generate your key?

[pinpox]

I'm not sure how to import that key. I generated one like shown in the screenshot and saved the two strings to files:

shell ❯ cat secret-key
0c 06 41 0d 17 db 68 5a 84 47 e7 e9 d7 a5 2f 2f

shell ❯ cat private-identity
22 f5 0a 2e 1a db

I then tried to import them into my testing yubikey:

shell ❯ ykman piv keys import 82 ./secret-key 
ERROR: Could not parse private key.

I suppose that is not the correct format that ykman exports for importing? Can you give me directions on how to test this?

I also have tried removing the spaces.

[pinpox]

I found some information regarding this. Citing from: https://smallstep.com/blog/access-your-homelab-anywhere/

It confirms that the private key is hardware-bound and non-exportable.

Crucially, the YubiKey will only attest a private key that's been generated directly on the YubiKey. If you try to attest an imported private key, it will fail:

Could this be the cause?

[orolhawion]

I don't quite get how you get from
age keys to Yubico OTPs...