Skip to content

Fix identity encryption always using piv-p256 instead of p256tag/mlkem768p256tag#17

Open
GaMoCh wants to merge 1 commit into
remko:mainfrom
GaMoCh:fix/identity-recipient-stanza-type
Open

Fix identity encryption always using piv-p256 instead of p256tag/mlkem768p256tag#17
GaMoCh wants to merge 1 commit into
remko:mainfrom
GaMoCh:fix/identity-recipient-stanza-type

Conversation

@GaMoCh
Copy link
Copy Markdown

@GaMoCh GaMoCh commented Apr 21, 2026

Summary

  • When encrypting with an identity (-i), the plugin always used piv-p256 stanza type, ignoring post-quantum keys
  • Now uses mlkem768p256tag when the identity has ML-KEM keys, and p256tag otherwise
  • Aligns with age-plugin-yubikey behavior of always using modern stanza types for encryption

Before / After

Before

age-plugin-se-before

After

age-plugin-se-after

Details

The runRecipientV1 function hardcoded .pivp256 for all identities passed via
add-identity, even when the identity contained ML-KEM-768 keys generated with --pq.
This meant age -e -i key.txt never used post-quantum encryption.

Recipients passed via add-recipient (-r) already correctly detected the stanza type
from the recipient string prefix. This fix applies equivalent logic for identities,
using the available key material to determine the appropriate stanza type.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant