Filippo Valsorda
20f9e8574f
agessh,tag/tagtest: handle recipient hint collisions
...
The four-byte SSH fingerprints (and tagged recipient tags) are hints to
avoid unnecessary password prompts or hardware interactions. Treat an
authenticated unwrap failure after a hint match as a false positive and
continue looking for a matching stanza.
Without this, a colliding recipient stanza that appears before the
valid stanza makes decryption fail even though the file is correctly
encrypted to the identity. Any password prompt or hardware interaction
has already happened by then.
Reported by Claude, Anthropic's AI assistant, and triaged by the
Anthropic security team in collaboration with Anthropic Research,
as ANT-2026-S9C25K8W.
2026-08-29 19:30:10 +02:00
Filippo Valsorda and Filippo Valsorda
e2d30695f2
cmd/age,tag: implement age1tagpq1.../p256mlkem768tag recipients
...
Test vectors generated from hpkewg/hpke-pq@19adaeb (hpkewg/hpke-pq#28 +
hpkewg/hpke-pq#32 ) and cfrg/draft-irtf-cfrg-concrete-hybrid-kems@1bbca40
(cfrg/draft-irtf-cfrg-concrete-hybrid-kems#16 ), plus the following diff:
diff --git a/reference-implementation/src/bin/generate.rs b/reference-implementation/src/bin/generate.rs
index 25e32e5..bc8f209 100644
--- a/reference-implementation/src/bin/generate.rs
+++ b/reference-implementation/src/bin/generate.rs
@@ -26,6 +26,15 @@ fn generate_test_vectors() -> TestVectors {
// 5. QSF-P384-MLKEM1024 + SHAKE256 + AES-256-GCM
vectors.push(TestVector::new::<QsfP384MlKem1024, Shake256, Aes256Gcm>());
+ vectors = TestVectors::new();
+
+ // age1pq - xwing
+ vectors.push(TestVector::new::<QsfX25519MlKem768, HkdfSha256, ChaChaPoly>());
+ // age1tag - p256tag
+ vectors.push(TestVector::new::<DhkemP256HkdfSha256, HkdfSha256, ChaChaPoly>());
+ // age1tagpq - p256mlkem768tag
+ vectors.push(TestVector::new::<QsfP256MlKem768, HkdfSha256, ChaChaPoly>());
+
vectors
}
diff --git a/reference-implementation/src/test_vectors.rs b/reference-implementation/src/test_vectors.rs
index 24335aa..4134fb5 100644
--- a/reference-implementation/src/test_vectors.rs
+++ b/reference-implementation/src/test_vectors.rs
@@ -369,6 +369,10 @@ impl TestVector {
(0x0051, 0x0011, 0x0002) => self.v::<QsfP384MlKem1024, Shake256, Aes256Gcm>(),
(0x0051, 0x0011, 0xffff) => self.v::<QsfP384MlKem1024, Shake256, ExportOnly>(),
+ // age pq combinations
+ (0x647a, 0x0001, 0x0003) => self.v::<QsfX25519MlKem768, HkdfSha256, ChaChaPoly>(),
+ (0x0050, 0x0001, 0x0003) => self.v::<QsfP256MlKem768, HkdfSha256, ChaChaPoly>(),
+
_ => Err(format!(
"Unsupported algorithm combination: KEM={:#x}, KDF={:#x}, AEAD={:#x}",
self.kem_id, self.kdf_id, self.aead_id
2025-12-22 19:41:12 +01:00
Filippo Valsorda
