From 3604609d98548b2a9867640969e99486af2602ce Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Sat, 29 Aug 2026 18:46:56 +0200 Subject: [PATCH] cmd/age-plugin-batchpass: correct documented scrypt limit Reported by Joe Doyle of Trail of Bits. --- cmd/age-plugin-batchpass/plugin-batchpass.go | 9 +++++---- doc/age-plugin-batchpass.1.ronn | 6 ++++-- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/cmd/age-plugin-batchpass/plugin-batchpass.go b/cmd/age-plugin-batchpass/plugin-batchpass.go index 66e2675..6fb8b5f 100644 --- a/cmd/age-plugin-batchpass/plugin-batchpass.go +++ b/cmd/age-plugin-batchpass/plugin-batchpass.go @@ -68,11 +68,12 @@ a file descriptor. Trailing newlines are stripped from the file contents. When encrypting, you can set AGE_PASSPHRASE_WORK_FACTOR to adjust the scrypt work factor (between 1 and 30, default 18). Higher values are more secure -but slower. +but slower. The age CLI refuses to decrypt files above 22, and so does this +plugin unless AGE_PASSPHRASE_MAX_WORK_FACTOR is set to at least the same value. -When decrypting, you can set AGE_PASSPHRASE_MAX_WORK_FACTOR to limit the -maximum scrypt work factor accepted (between 1 and 30, default 30). This can -be used to avoid very slow decryptions.` +When decrypting, you can set AGE_PASSPHRASE_MAX_WORK_FACTOR to change the +maximum scrypt work factor accepted (between 1 and 30, default 22). This can +be used to avoid very slow decryptions, or to allow slower ones.` // Version can be set at link time to override debug.BuildInfo.Main.Version when // building manually without git history. It should look like "v1.2.3". diff --git a/doc/age-plugin-batchpass.1.ronn b/doc/age-plugin-batchpass.1.ronn index c02818e..425fbb8 100644 --- a/doc/age-plugin-batchpass.1.ronn +++ b/doc/age-plugin-batchpass.1.ronn @@ -65,11 +65,13 @@ persisted in the shell history or leaked to other users on multi-user systems. The scrypt work factor to use when encrypting. Must be between 1 and 30. Default is 18. Higher values are more secure but slower. + The age CLI refuses to decrypt files above 22, and so does this plugin + unless `AGE_PASSPHRASE_MAX_WORK_FACTOR` is set to at least the same value. * `AGE_PASSPHRASE_MAX_WORK_FACTOR`: The maximum scrypt work factor to accept when decrypting. - Must be between 1 and 30. Default is 30. - Can be used to avoid very slow decryptions. + Must be between 1 and 30. Default is 22. + Can be used to avoid very slow decryptions, or to allow slower ones. ## EXAMPLES