can't pass password via stdin during decrypt

[rdslw]

Environment

• OS: Linux 6.9.11
• age version: 1.2.0

PROBLEM

Currently (afaik) it's not possible to pass passphrase to age via stdin, like:
echo -n "$passphrase" | age -d -o output_file input_file

Here, age knows that stdin is NOT used for data, because I specified input file explicitly.

This also does not work with:
some_cli_password_manager | age -d -i - -o output_file input_file

Rationale:

1. passphrase is eventually read from stdin
2. sometimes you must use passswords (can't use keys) in script & automation
3. most cli tools allows it (cryptsetup etc.)
4. also Reading pasted armored input from a terminal clashes with password prompt #364

[Gunni]

what if you pass it in like age ... <(echo -n "$passphrase") ...? Note that I didn't test, just aware of that shell feature.

[rdslw]

what if you pass it in like age ... <(echo -n "$passphrase") ...? Note that I didn't test, just aware of that shell feature.

Any method which is using stdin (like <( cmd ) here) will not work, due to the age not supporting passphrase via stdin during decryption. This is what I'm actually asking for :)

[Gunni]

But the command I provided does not use stdin? It makes a pipe kind of file and returns the path to it to the command.

[rdslw]

But the command I provided does not use stdin? It makes a pipe kind of file and returns the path to it to the command.

That will not work because age --decrypt does not take passphrase as an command line argument (see below age --help).

The problem is that INPUT may (but not must) be used by age for content of encrypt/decrypt operation, hence age must distinguish such mode (content on stdin) from password on stdin scenario, in two ways:

• either implictly (user provided input as filename) hence if stdin is attached it must be key/passphrase material,
• either explicitly (by using some kind of option plus stdin).

$ age --help  
Usage:
    age [--encrypt] (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
    age [--encrypt] --passphrase [--armor] [-o OUTPUT] [INPUT]
    age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]

[AlexanderYastrebov]

Here, age knows that stdin is NOT used for data, because I specified input file explicitly.

But it needs to tell piped input vs terminal apart which might be tricky.
E.g. this:

diff --git a/cmd/age/age.go b/cmd/age/age.go
index e5d17e2..29fa88e 100644
--- a/cmd/age/age.go
+++ b/cmd/age/age.go
@@ -455,10 +455,19 @@ func decryptNotPass(flags identityFlags, in io.Reader, out io.Writer) {
 }
 
 func decryptPass(in io.Reader, out io.Writer) {
+       passphrase := passphrasePromptForDecryption
+
+       if in != os.Stdin && !term.IsTerminal(int(os.Stdin.Fd())) {
+               passphrase = func() (string, error) {
+                       b, err := io.ReadAll(os.Stdin)
+                       return string(b), err
+               }
+       }
+
        identities := []age.Identity{
                // If there is an scrypt recipient (it will have to be the only one and)
                // this identity will be invoked.
-               &LazyScryptIdentity{passphrasePromptForDecryption},
+               &LazyScryptIdentity{passphrase},
        }
 
        decrypt(identities, in, out)

works in terminal but breaks testcript tests.

An alternative might be to add passphrase file flag and then use /dev/stdin as a value.

[rdslw]

works in terminal but breaks testcript tests.

can you expand on this?

[AlexanderYastrebov]

works in terminal but breaks testcript tests.

can you expand on this?

Some existing tests that use terminal input need to be fixed, see #641

[FiloSottile]

The new batchpass plugin handles non-interactive passphrase encryption. See #256 (comment) for usage and a warning.

[Earnestly]

Solved:

AGE_PASSPHRASE="$password" age -j batchpass -d "$id".age | age -i - -d file > file.age
AGE_PASSPHRASE="$password" age -j batchpass -d "$id".age | age -i - -d file.age > file

---

I would like some guidance on a particular workflow which I am struggling to use with age.

The idea is to create a passphrase protected key which is then used to encrypt and decrypt files.

One goal is to create and use this key in such a way that no cleartext is ever written to a filesystem (sans swap).

Currently I am using the age-plugin-batchpass to create the key:-

# nb. age-keygen writes the public key to standard error, but it also might
#     write other errors to standard error so this cannot be a reliable way to
#     capture the information.
age-keygen 2> /dev/null \
| AGE_PASSPHRASE="$password" age -j batchpass -e \
| tee tmp.age \
| AGE_PASSPHRASE="$password" age -j batchpass -d \
| age-keygen -y \
| {
    IFS= read -r id

    case $id in
    age1*)
        mv -f -- tmp.age "$id".age
        printf '%s\n' "$id".age ;;
    esac
}

I then use this approach for encrypting and decrypting files:-

age -r "$id" -e < file > file.age
age -i "$id".age -d < file.age

However when using the command age -i "$id".age I am prompted for a passphrase to unluck the identity file.

This is where I hit a roadblock as there appears no way to supply a passphrase in an automatic manner (I am aiming to use keyctl to cache this):-

AGE_PASSPHRASE="$password" age -j batchpass -i "$id".age -d < file.age
age: error: batchpass plugin: file is not passphrase-encrypted
age: report unexpected or unhelpful errors at https://filippo.io/age/report

Do you have any advice for how I might tackle this, even if there is a better alternative?

Edit2: [SOLVED] Apparently this works:

AGE_PASSPHRASE=f age -j batchpass -d "$id".age | age -i - -d file > file.age
AGE_PASSPHRASE=f age -j batchpass -d "$id".age | age -i - -d file.age > file

---

Edit: For comparison, using sequoia's sq utility to roughly approximate the same idea:-

printf %s "$password" \
| sq --quiet key generate --new-password-file=/dev/stdin --own-key --no-userids \
                          --can-encrypt=storage --cannot-sign --cannot-authenticate \
                          --expiration=never --rev-cert=- --output=key.pgp > /dev/null

sq --quiet encrypt --without-signature --binary --for-file=key.pgp --output=file.pgp file

printf %s "$password" \
| sq --quiet --batch --password-file=/dev/stdin decrypt --recipient-file=key.pgp file.pgp