cmd/age: touch up help text

Buffering only when the armorFlag is set disregards use cases where data
from a tty stdin is decrypted or where binary data goes to a tty stdout.

Buffering is only necessary if stdin is a tty and stdout is a tty.

Co-authored-by: Filippo Valsorda <hi@filippo.io>

.cirrus.yml

@@ -6,4 +6,4 @@ freebsd_12_task:
     image: freebsd-12-1-release-amd64
   install_script: pkg install -y go
   build_script: go build -v ./...
-  test_script: go test -v ./...
+  test_script: go test -race ./...

.github/workflows/build.yml

@@ -0,0 +1,72 @@
+on:
+  release:
+    types: [published]
+  push:
+  pull_request:
+name: Build binaries
+jobs:
+  binaries:
+    name: Build and upload
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.x
+      - name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Build binaries
+        run: |
+          VERSION=$(git describe --tags)
+          function build_age() {
+            DIR="$(mktemp -d)"
+            mkdir "$DIR/age"
+            cp LICENSE "$DIR/age"
+            echo -e "\n---\n" >> "$DIR/age/LICENSE"
+            curl "https://golang.org/LICENSE?m=text" >> "$DIR/age/LICENSE"
+            go build -o "$DIR/age" -ldflags "-X main.Version=$VERSION" ./cmd/...
+            if [ "$GOOS" == "windows" ]; then
+              ( cd "$DIR"; zip age.zip -r age )
+              mv "$DIR/age.zip" "age-$VERSION-$GOOS-$GOARCH.zip"
+            else
+              tar -cvzf "age-$VERSION-$GOOS-$GOARCH.tar.gz" -C "$DIR" age
+            fi
+          }
+          export CGO_ENABLED=0
+          GOOS=linux GOARCH=amd64 build_age
+          GOOS=linux GOARCH=arm GOARM=6 build_age
+          GOOS=linux GOARCH=arm64 build_age
+          GOOS=darwin GOARCH=amd64 build_age
+          GOOS=windows GOARCH=amd64 build_age
+      - name: Upload workflow artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: age-binaries
+          path: age-*
+      - name: Upload release artifacts
+        uses: actions/github-script@v3
+        if: ${{ github.event_name == 'release' }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require("fs").promises;
+            const { repo: { owner, repo }, sha } = context;
+
+            const release = await github.repos.getReleaseByTag({
+              owner, repo,
+              tag: process.env.GITHUB_REF.replace("refs/tags/", ""),
+            });
+            console.log("Release:", { release });
+
+            for (let file of await fs.readdir(".")) {
+              if (!file.startsWith("age-")) continue;
+              console.log("Uploading", file);
+              await github.repos.uploadReleaseAsset({
+                owner, repo,
+                release_id: release.data.id,
+                name: file,
+                data: await fs.readFile(file),
+              });            
+            }

.github/workflows/interop.yml

@@ -1,9 +1,8 @@
 name: Interoperability tests
- 
 on: push
-
 jobs:
   trigger:
+    name: Trigger
     runs-on: ubuntu-latest
     steps:
       - name: Trigger interoperability tests in str4d/rage

.github/workflows/test.yml

@@ -0,0 +1,22 @@
+on: [push, pull_request]
+name: Go tests
+jobs:
+  test:
+    name: Test
+    strategy:
+      fail-fast: false
+      matrix:
+        go: [1.14.x, 1.x]
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Install Go ${{ matrix.go }}
+        uses: actions/setup-go@v2
+        with:
+          go-version: ${{ matrix.go }}
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      # - name: Run analyses
+      #   run: go run analysis.go ./...
+      - name: Run tests
+        run: go test -race ./...

.travis.yml

@@ -1,5 +0,0 @@
-os: linux
-arch: arm64
-dist: bionic
-language: go
-go: 1.x

HomebrewFormula/age.rb

@@ -14,7 +14,7 @@ class Age < Formula
 
   def install
     mkdir bin
-    system "go", "build", "-trimpath", "-o", bin, "filippo.io/age/cmd/..."
+    system "go", "build", "-trimpath", "-o", bin, "-ldflags", "-X main.Version=v#{version}", "filippo.io/age/cmd/..."
     prefix.install_metafiles
   end
 end

README.md

@@ -1,6 +1,8 @@
 # age
 
-age is a simple, modern and secure file encryption tool.
+[![pkg.go.dev](https://pkg.go.dev/badge/filippo.io/age)](https://pkg.go.dev/filippo.io/age)
+
+age is a simple, modern and secure file encryption tool, format, and library.
 
 It features small explicit keys, no config options, and UNIX-style composability.
 
@@ -8,7 +10,7 @@ It features small explicit keys, no config options, and UNIX-style composability
 $ age-keygen -o key.txt
 Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
 $ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
-$ age -d -i key.txt data.tar.gz.age > data.tar.gz
+$ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
 ```
 
 The format specification is at [age-encryption.org/v1](https://age-encryption.org/v1). To discuss the spec or other age related topics, please email [the mailing list](https://groups.google.com/d/forum/age-dev) at age-dev@googlegroups.com. age was designed by [@Benjojo12](https://twitter.com/Benjojo12) and [@FiloSottile](https://twitter.com/FiloSottile).
@@ -19,25 +21,32 @@ An alternative interoperable Rust implementation is available at [github.com/str
 
 ```
 Usage:
-    age -r RECIPIENT [-a] [-o OUTPUT] [INPUT]
-    age --decrypt [-i KEY] [-o OUTPUT] [INPUT]
+    age (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
+    age --passphrase [--armor] [-o OUTPUT] [INPUT]
+    age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]
 
 Options:
     -o, --output OUTPUT         Write the result to the file at path OUTPUT.
     -a, --armor                 Encrypt to a PEM encoded format.
     -p, --passphrase            Encrypt with a passphrase.
     -r, --recipient RECIPIENT   Encrypt to the specified RECIPIENT. Can be repeated.
+    -R, --recipients-file PATH  Encrypt to recipients listed at PATH. Can be repeated.
     -d, --decrypt               Decrypt the input to the output.
-    -i, --identity KEY          Use the private key file at path KEY. Can be repeated.
+    -i, --identity PATH         Use the identity file at PATH. Can be repeated.
 
 INPUT defaults to standard input, and OUTPUT defaults to standard output.
 
-RECIPIENT can be an age public key, as generated by age-keygen, ("age1...")
+RECIPIENT can be an age public key generated by age-keygen ("age1...")
 or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
 
-KEY is a path to a file with age secret keys, one per line
-(ignoring "#" prefixed comments and empty lines), or to an SSH key file.
-Multiple keys can be provided, and any unused ones will be ignored.
+Recipient files contain one or more recipients, one per line. Empty lines
+and lines starting with "#" are ignored as comments. "-" may be used to
+read recipients from standard input.
+
+Identity files contain one or more secret keys ("AGE-SECRET-KEY-1..."),
+one per line, or an SSH key. Empty lines and lines starting with "#" are
+ignored as comments. Multiple key files can be provided, and any unused ones
+will be ignored. "-" may be used to read identities from standard input.
 ```
 
 ### Multiple recipients
@@ -49,6 +58,21 @@ $ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sf
     -r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example.jpg
 ```
 
+#### Recipient files
+
+Multiple recipients can also be listed one per line in one or more files passed with the `-R/--recipients-file` flag.
+
+```
+$ cat recipients.txt
+# Alice
+age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
+# Bob
+age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg
+$ age -R recipients.txt example.jpg > example.jpg.age
+```
+
+If the argument to `-R` (or `-i`) is `-`, the file is read from standard input.
+
 ### Passphrases
 
 Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
@@ -66,14 +90,22 @@ Enter passphrase:
 As a convenience feature, age also supports encrypting to `ssh-rsa` and `ssh-ed25519` SSH public keys, and decrypting with the respective private key file. (`ssh-agent` is not supported.)
 
 ```
-$ cat ~/.ssh/id_ed25519.pub
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIZDRcvS8PnhXr30WKSKmf7WKKi92ACUa5nW589WukJz filippo@Bistromath.local
-$ age -r "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIZDRcvS8PnhXr30WKSKmf7WKKi92ACUa5nW589WukJz" example.jpg > example.jpg.age
+$ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
 $ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
 ```
 
 Note that SSH key support employs more complex cryptography, and embeds a public key tag in the encrypted file, making it possible to track files that are encrypted to a specific public key.
 
+#### Encrypting to a GitHub user
+
+Combining SSH key support and `-R`, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
+
+```
+$ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
+```
+
+Keep in mind that people might not protect SSH keys long-term, since they are revokable when used only for authentication, and that SSH keys held on YubiKeys can't be used to decrypt files.
+
 ## Installation
 
 On macOS or Linux, you can use Homebrew:

age.go

@@ -10,10 +10,31 @@
 // For most use cases, use the Encrypt and Decrypt functions with
 // X25519Recipient and X25519Identity. If passphrase encryption is required, use
 // ScryptRecipient and ScryptIdentity. For compatibility with existing SSH keys
-// use the filippo.io/agessh package.
+// use the filippo.io/age/agessh package.
 //
-// Age encrypted files are binary and not malleable, for encoding them as text,
+// Age encrypted files are binary and not malleable. For encoding them as text,
 // use the filippo.io/age/armor package.
+//
+// Key management
+//
+// Age does not have a global keyring. Instead, since age keys are small,
+// textual, and cheap, you are encoraged to generate dedicated keys for each
+// task and application.
+//
+// Recipient public keys can be passed around as command line flags and in
+// config files, while secret keys should be stored in dedicated files, through
+// secret management systems, or as environment variables.
+//
+// There is no default path for age keys. Instead, they should be stored at
+// application-specific paths. The CLI supports files where private keys are
+// listed one per line, ignoring empty lines and lines starting with "#". These
+// files can be parsed with ParseIdentities.
+//
+// When integrating age into a new system, it's recommended that you only
+// support X25519 keys, and not SSH keys. The latter are supported for manual
+// encryption operations. If you need to tie into existing key management
+// infrastructure, you might want to consider implementing your own Recipient
+// and Identity.
 package age
 
 import (
@@ -66,17 +87,22 @@ type Stanza struct {
 	Body []byte
 }
 
-// Encrypt returns a WriteCloser. Writes to the returned value are encrypted and
-// written to dst as an age file. Every recipient will be able to decrypt the file.
+const fileKeySize = 16
+const streamNonceSize = 16
+
+// Encrypt encrypts a file to one or more recipients.
 //
-// The caller must call Close on the returned value when done for the last chunk
-// to be encrypted and flushed to dst.
+// Writes to the returned WriteCloser are encrypted and written to dst as an age
+// file. Every recipient will be able to decrypt the file.
+//
+// The caller must call Close on the WriteCloser when done for the last chunk to
+// be encrypted and flushed to dst.
 func Encrypt(dst io.Writer, recipients ...Recipient) (io.WriteCloser, error) {
 	if len(recipients) == 0 {
 		return nil, errors.New("no recipients specified")
 	}
 
-	fileKey := make([]byte, 16)
+	fileKey := make([]byte, fileKeySize)
 	if _, err := rand.Read(fileKey); err != nil {
 		return nil, err
 	}
@@ -102,7 +128,7 @@ func Encrypt(dst io.Writer, recipients ...Recipient) (io.WriteCloser, error) {
 		return nil, fmt.Errorf("failed to write header: %v", err)
 	}
 
-	nonce := make([]byte, 16)
+	nonce := make([]byte, streamNonceSize)
 	if _, err := rand.Read(nonce); err != nil {
 		return nil, err
 	}
@@ -113,7 +139,9 @@ func Encrypt(dst io.Writer, recipients ...Recipient) (io.WriteCloser, error) {
 	return stream.NewWriter(streamKey(fileKey, nonce), dst)
 }
 
-// Decrypt returns a Reader reading the decrypted plaintext of the age file read
+// Decrypt decrypts a file encrypted to one or more identities.
+//
+// It returns a Reader reading the decrypted plaintext of the age file read
 // from src. All identities will be tried until one successfully decrypts the file.
 func Decrypt(src io.Reader, identities ...Identity) (io.Reader, error) {
 	if len(identities) == 0 {
@@ -173,7 +201,7 @@ RecipientsLoop:
 		return nil, errors.New("bad header MAC")
 	}
 
-	nonce := make([]byte, 16)
+	nonce := make([]byte, streamNonceSize)
 	if _, err := io.ReadFull(payload, nonce); err != nil {
 		return nil, fmt.Errorf("failed to read nonce: %v", err)
 	}

age_test.go

@@ -8,11 +8,12 @@ package age_test
 
 import (
 	"bytes"
-	"encoding/hex"
 	"fmt"
 	"io"
 	"io/ioutil"
 	"log"
+	"os"
+	"strings"
 	"testing"
 
 	"filippo.io/age"
@@ -43,31 +44,59 @@ func ExampleEncrypt() {
 	// Encrypted file size: 219
 }
 
-var fileContents, _ = hex.DecodeString("6167652d656e6372797074696f6e2e6f72" +
-	"672f76310a2d3e20583235353139203868726c4d2b5a4247334464346646322b61353" +
-	"8337a64544957446b382f5234316b43595a7376775457340a794f345059646c4d5744" +
-	"4a2b437867554e527159355a30542f6d2b6733464368356a4978474c62435658630a2" +
-	"d2d2d20492f696d65765a7a79383132304a537a6d4a6e6d6e2f4b4d6b337035413131" +
-	"5638334e6b34316d394e50450a70c5e53624a1520753f92c5ad10ecab273ba4d61178" +
-	"07713e83820417a1df2ca08182272c8f85c857734a1311a3b75e98d0eaf")
+// DO NOT hardcode the private key. Store it in a secret storage solution,
+// on disk if the local machine is trusted, or have the user provide it.
+var privateKey string
 
-var privateKey = "AGE-SECRET-KEY-184JMZMVQH3E6U0PSL869004Y3U2NYV7R30EU99CSEDNPH02YUVFSZW44VU"
+func init() {
+	privateKey = "AGE-SECRET-KEY-184JMZMVQH3E6U0PSL869004Y3U2NYV7R30EU99CSEDNPH02YUVFSZW44VU"
+}
 
 func ExampleDecrypt() {
-	// DO NOT hardcode the private key. Store it in a secret storage solution,
-	// on disk if the local machine is trusted, or have the user provide it.
 	identity, err := age.ParseX25519Identity(privateKey)
 	if err != nil {
-		log.Fatalf("Failed to parse private key %q: %v", privateKey, err)
+		log.Fatalf("Failed to parse private key: %v", err)
 	}
 
-	out := &bytes.Buffer{}
-	f := bytes.NewReader(fileContents)
+	f, err := os.Open("testdata/example.age")
+	if err != nil {
+		log.Fatalf("Failed to open file: %v", err)
+	}
 
 	r, err := age.Decrypt(f, identity)
 	if err != nil {
 		log.Fatalf("Failed to open encrypted file: %v", err)
 	}
+	out := &bytes.Buffer{}
+	if _, err := io.Copy(out, r); err != nil {
+		log.Fatalf("Failed to read encrypted file: %v", err)
+	}
+
+	fmt.Printf("File contents: %q\n", out.Bytes())
+	// Output:
+	// File contents: "Black lives matter."
+}
+
+func ExampleParseIdentities() {
+	keyFile, err := os.Open("testdata/keys.txt")
+	if err != nil {
+		log.Fatalf("Failed to open private keys file: %v", err)
+	}
+	identities, err := age.ParseIdentities(keyFile)
+	if err != nil {
+		log.Fatalf("Failed to parse private key: %v", err)
+	}
+
+	f, err := os.Open("testdata/example.age")
+	if err != nil {
+		log.Fatalf("Failed to open file: %v", err)
+	}
+
+	r, err := age.Decrypt(f, identities...)
+	if err != nil {
+		log.Fatalf("Failed to open encrypted file: %v", err)
+	}
+	out := &bytes.Buffer{}
 	if _, err := io.Copy(out, r); err != nil {
 		log.Fatalf("Failed to read encrypted file: %v", err)
 	}
@@ -162,3 +191,35 @@ func TestEncryptDecryptScrypt(t *testing.T) {
 		t.Errorf("wrong data: %q, excepted %q", outBytes, helloWorld)
 	}
 }
+
+func TestParseIdentities(t *testing.T) {
+	tests := []struct {
+		name      string
+		wantCount int
+		wantErr   bool
+		file      string
+	}{
+		{"valid", 2, false, `
+# this is a comment
+# AGE-SECRET-KEY-1705XN76M8EYQ8M9PY4E2G3KA8DN7NSCGT3V4HMN20H3GCX4AS6HSSTG8D3
+#
+
+AGE-SECRET-KEY-1D6K0SGAX3NU66R4GYFZY0UQWCLM3UUSF3CXLW4KXZM342WQSJ82QKU59QJ
+AGE-SECRET-KEY-19WUMFE89H3928FRJ5U3JYRNHM6CERQGKSQ584AQ8QY7T7R09D32SWE4DYH`},
+		{"invalid", 0, true, `
+AGE-SECRET-KEY-1705XN76M8EYQ8M9PY4E2G3KA8DN7NSCGT3V4HMN20H3GCX4AS6HSSTG8D3
+AGE-SECRET-KEY--1D6K0SGAX3NU66R4GYFZY0UQWCLM3UUSF3CXLW4KXZM342WQSJ82QKU59Q`},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := age.ParseIdentities(strings.NewReader(tt.file))
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ParseIdentities() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if len(got) != tt.wantCount {
+				t.Errorf("ParseIdentities() returned %d identities, want %d", len(got), tt.wantCount)
+			}
+		})
+	}
+}

agessh/agessh.go

@@ -5,11 +5,14 @@
 // https://developers.google.com/open-source/licenses/bsd
 
 // Package agessh provides age.Identity and age.Recipient implementations of
-// types "ssh-rsa" and "ssh-ed25519", which allow reusing existing SSH key files
-// for encryption with age-encryption.org/v1.
+// types "ssh-rsa" and "ssh-ed25519", which allow reusing existing SSH keys for
+// encryption with age-encryption.org/v1.
 //
-// These should only be used for compatibility with existing keys, and native
-// X25519 keys should be preferred otherwise.
+// These recipient types should only be used for compatibility with existing
+// keys, and native X25519 keys should be preferred otherwise.
+//
+// Note that these recipient types are not anonymous: the encrypted message will
+// include a short 32-bit ID of the public key.
 package agessh
 
 import (
@@ -21,10 +24,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"math/big"
 
 	"filippo.io/age"
 	"filippo.io/age/internal/format"
+	"filippo.io/edwards25519"
 	"golang.org/x/crypto/chacha20poly1305"
 	"golang.org/x/crypto/curve25519"
 	"golang.org/x/crypto/hkdf"
@@ -136,20 +139,24 @@ func NewEd25519Recipient(pk ssh.PublicKey) (*Ed25519Recipient, error) {
 	if pk.Type() != "ssh-ed25519" {
 		return nil, errors.New("SSH public key is not an Ed25519 key")
 	}
-	r := &Ed25519Recipient{
-		sshKey: pk,
-	}
 
-	if pk, ok := pk.(ssh.CryptoPublicKey); ok {
-		if pk, ok := pk.CryptoPublicKey().(ed25519.PublicKey); ok {
-			r.theirPublicKey = ed25519PublicKeyToCurve25519(pk)
-		} else {
-			return nil, errors.New("unexpected public key type")
-		}
-	} else {
+	cpk, ok := pk.(ssh.CryptoPublicKey)
+	if !ok {
 		return nil, errors.New("pk does not implement ssh.CryptoPublicKey")
 	}
-	return r, nil
+	epk, ok := cpk.CryptoPublicKey().(ed25519.PublicKey)
+	if !ok {
+		return nil, errors.New("unexpected public key type")
+	}
+	mpk, err := ed25519PublicKeyToCurve25519(epk)
+	if err != nil {
+		return nil, fmt.Errorf("invalid Ed25519 public key: %v", err)
+	}
+
+	return &Ed25519Recipient{
+		sshKey:         pk,
+		theirPublicKey: mpk,
+	}, nil
 }
 
 func ParseRecipient(s string) (age.Recipient, error) {
@@ -174,35 +181,14 @@ func ParseRecipient(s string) (age.Recipient, error) {
 	return r, nil
 }
 
-var curve25519P, _ = new(big.Int).SetString("57896044618658097711785492504343953926634992332820282019728792003956564819949", 10)
-
-func ed25519PublicKeyToCurve25519(pk ed25519.PublicKey) []byte {
-	// ed25519.PublicKey is a little endian representation of the y-coordinate,
-	// with the most significant bit set based on the sign of the x-coordinate.
-	bigEndianY := make([]byte, ed25519.PublicKeySize)
-	for i, b := range pk {
-		bigEndianY[ed25519.PublicKeySize-i-1] = b
+func ed25519PublicKeyToCurve25519(pk ed25519.PublicKey) ([]byte, error) {
+	// See https://blog.filippo.io/using-ed25519-keys-for-encryption and
+	// https://pkg.go.dev/filippo.io/edwards25519#Point.BytesMontgomery.
+	p, err := (&edwards25519.Point{}).SetBytes(pk)
+	if err != nil {
+		return nil, err
 	}
-	bigEndianY[0] &= 0b0111_1111
-
-	// The Montgomery u-coordinate is derived through the bilinear map
-	//
-	//     u = (1 + y) / (1 - y)
-	//
-	// See https://blog.filippo.io/using-ed25519-keys-for-encryption.
-	y := new(big.Int).SetBytes(bigEndianY)
-	denom := big.NewInt(1)
-	denom.ModInverse(denom.Sub(denom, y), curve25519P) // 1 / (1 - y)
-	u := y.Mul(y.Add(y, big.NewInt(1)), denom)
-	u.Mod(u, curve25519P)
-
-	out := make([]byte, curve25519.PointSize)
-	uBytes := u.Bytes()
-	for i, b := range uBytes {
-		out[len(uBytes)-i-1] = b
-	}
-
-	return out
+	return p.BytesMontgomery(), nil
 }
 
 const ed25519Label = "age-encryption.org/v1/ssh-ed25519"
@@ -346,6 +332,12 @@ func (i *Ed25519Identity) Unwrap(block *age.Stanza) ([]byte, error) {
 }
 
 // aeadEncrypt and aeadDecrypt are copied from package age.
+//
+// They don't limit the file key size because multi-key attacks are irrelevant
+// against the ssh-ed25519 recipient. Being an asymmetric recipient, it would
+// only allow a more efficient search for accepted public keys against a
+// decryption oracle, but the ssh-X recipients are not anonymous (they have a
+// short recipient hash).
 
 func aeadEncrypt(key, plaintext []byte) ([]byte, error) {
 	aead, err := chacha20poly1305.New(key)

cmd/age-keygen/keygen.go

@@ -11,26 +11,74 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"runtime/debug"
 	"time"
 
 	"filippo.io/age"
 	"golang.org/x/crypto/ssh/terminal"
 )
 
+const usage = `Usage:
+    age-keygen [-o OUTPUT]
+
+Options:
+    -o, --output OUTPUT       Write the key to the file at path OUTPUT.
+
+age-keygen generates a new standard X25519 key pair, and outputs it to
+standard output or to the OUTPUT file.
+
+If an OUTPUT file is specified, the public key is printed to standard error.
+If OUTPUT already exists, it is not overwritten.
+
+Examples:
+
+    $ age-keygen
+    # created: 2021-01-02T15:30:45+01:00
+    # public key: age1lvyvwawkr0mcnnnncaghunadrqkmuf9e6507x9y920xxpp866cnql7dp2z
+    AGE-SECRET-KEY-1N9JEPW6DWJ0ZQUDX63F5A03GX8QUW7PXDE39N8UYF82VZ9PC8UFS3M7XA9
+
+    $ age-keygen -o key.txt
+    Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p`
+
+// Version can be set at link time to override debug.BuildInfo.Main.Version,
+// which is "(devel)" when building from within the module. See
+// golang.org/issue/29814 and golang.org/issue/29228.
+var Version string
+
 func main() {
 	log.SetFlags(0)
+	flag.Usage = func() { fmt.Fprintf(os.Stderr, "%s\n", usage) }
 
-	outFlag := flag.String("o", "", "output to `FILE` (default stdout)")
+	var (
+		versionFlag bool
+		outFlag     string
+	)
+
+	flag.BoolVar(&versionFlag, "version", false, "print the version")
+	flag.StringVar(&outFlag, "o", "", "output to `FILE` (default stdout)")
+	flag.StringVar(&outFlag, "output", "", "output to `FILE` (default stdout)")
 	flag.Parse()
 	if len(flag.Args()) != 0 {
 		log.Fatalf("age-keygen takes no arguments")
 	}
+	if versionFlag {
+		if Version != "" {
+			fmt.Println(Version)
+			return
+		}
+		if buildInfo, ok := debug.ReadBuildInfo(); ok {
+			fmt.Println(buildInfo.Main.Version)
+			return
+		}
+		fmt.Println("(unknown)")
+		return
+	}
 
 	out := os.Stdout
-	if name := *outFlag; name != "" {
-		f, err := os.OpenFile(name, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	if outFlag != "" {
+		f, err := os.OpenFile(outFlag, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
 		if err != nil {
-			log.Fatalf("Failed to open output file %q: %v", name, err)
+			log.Fatalf("Failed to open output file %q: %v", outFlag, err)
 		}
 		defer f.Close()
 		out = f
@@ -38,8 +86,7 @@ func main() {
 
 	if fi, err := out.Stat(); err == nil {
 		if fi.Mode().IsRegular() && fi.Mode().Perm()&0004 != 0 {
-			fmt.Fprintf(os.Stderr, "Warning: writing to a world-readable file.\n"+
-				"Consider setting the umask to 066 and trying again.\n")
+			fmt.Fprintf(os.Stderr, "Warning: writing secret key to a world-readable file.\n")
 		}
 	}
 

cmd/age/age.go

@@ -14,6 +14,7 @@ import (
 	"io"
 	_log "log"
 	"os"
+	"runtime/debug"
 	"strings"
 
 	"filippo.io/age"
@@ -31,42 +32,62 @@ func (f *multiFlag) Set(value string) error {
 }
 
 const usage = `Usage:
-    age -r RECIPIENT [-a] [-o OUTPUT] [INPUT]
-    age --decrypt [-i KEY] [-o OUTPUT] [INPUT]
+    age (-r RECIPIENT | -R PATH)... [--armor] [-o OUTPUT] [INPUT]
+    age --passphrase [--armor] [-o OUTPUT] [INPUT]
+    age --decrypt [-i PATH]... [-o OUTPUT] [INPUT]
 
 Options:
     -o, --output OUTPUT         Write the result to the file at path OUTPUT.
     -a, --armor                 Encrypt to a PEM encoded format.
     -p, --passphrase            Encrypt with a passphrase.
     -r, --recipient RECIPIENT   Encrypt to the specified RECIPIENT. Can be repeated.
+    -R, --recipients-file PATH  Encrypt to recipients listed at PATH. Can be repeated.
     -d, --decrypt               Decrypt the input to the output.
-    -i, --identity KEY          Use the private key file at path KEY. Can be repeated.
+    -i, --identity PATH         Use the identity file at PATH. Can be repeated.
 
 INPUT defaults to standard input, and OUTPUT defaults to standard output.
 
-RECIPIENT can be an age public key, as generated by age-keygen, ("age1...")
+RECIPIENT can be an age public key generated by age-keygen ("age1...")
 or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
 
-KEY is a path to a file with age secret keys, one per line
-(ignoring "#" prefixed comments and empty lines), or to an SSH key file.
-Multiple keys can be provided, and any unused ones will be ignored.
+Recipient files contain one or more recipients, one per line. Empty lines
+and lines starting with "#" are ignored as comments. "-" may be used to
+read recipients from standard input.
+
+Identity files contain one or more secret keys ("AGE-SECRET-KEY-1..."),
+one per line, or an SSH key. Empty lines and lines starting with "#" are
+ignored as comments. Multiple key files can be provided, and any unused ones
+will be ignored. "-" may be used to read identities from standard input.
 
 Example:
     $ age-keygen -o key.txt
     Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
     $ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
-    $ age -d -i key.txt -o data.tar.gz data.tar.gz.age`
+    $ age --decrypt -i key.txt -o data.tar.gz data.tar.gz.age`
+
+// Version can be set at link time to override debug.BuildInfo.Main.Version,
+// which is "(devel)" when building from within the module. See
+// golang.org/issue/29814 and golang.org/issue/29228.
+var Version string
 
 func main() {
 	_log.SetFlags(0)
 	flag.Usage = func() { fmt.Fprintf(os.Stderr, "%s\n", usage) }
 
+	if len(os.Args) == 1 {
+		flag.Usage()
+		os.Exit(1)
+	}
+
 	var (
-		outFlag                          string
-		decryptFlag, armorFlag, passFlag bool
-		recipientFlags, identityFlags    multiFlag
+		outFlag                       string
+		decryptFlag, armorFlag        bool
+		passFlag, versionFlag         bool
+		recipientFlags, identityFlags multiFlag
+		recipientsFileFlags           multiFlag
 	)
 
+	flag.BoolVar(&versionFlag, "version", false, "print the version")
 	flag.BoolVar(&decryptFlag, "d", false, "decrypt the input")
 	flag.BoolVar(&decryptFlag, "decrypt", false, "decrypt the input")
 	flag.BoolVar(&passFlag, "p", false, "use a passphrase")
@@ -77,10 +98,25 @@ func main() {
 	flag.BoolVar(&armorFlag, "armor", false, "generate an armored file")
 	flag.Var(&recipientFlags, "r", "recipient (can be repeated)")
 	flag.Var(&recipientFlags, "recipient", "recipient (can be repeated)")
+	flag.Var(&recipientsFileFlags, "R", "recipients file (can be repeated)")
+	flag.Var(&recipientsFileFlags, "recipients-file", "recipients file (can be repeated)")
 	flag.Var(&identityFlags, "i", "identity (can be repeated)")
 	flag.Var(&identityFlags, "identity", "identity (can be repeated)")
 	flag.Parse()
 
+	if versionFlag {
+		if Version != "" {
+			fmt.Println(Version)
+			return
+		}
+		if buildInfo, ok := debug.ReadBuildInfo(); ok {
+			fmt.Println(buildInfo.Main.Version)
+			return
+		}
+		fmt.Println("(unknown)")
+		return
+	}
+
 	if flag.NArg() > 1 {
 		logFatalf("Error: too many arguments.\n" +
 			"age accepts a single optional argument for the input file.")
@@ -99,21 +135,29 @@ func main() {
 			logFatalf("Error: -r/--recipient can't be used with -d/--decrypt.\n" +
 				"Did you mean to use -i/--identity to specify a private key?")
 		}
+		if len(recipientsFileFlags) > 0 {
+			logFatalf("Error: -R/--recipients-file can't be used with -d/--decrypt.\n" +
+				"Did you mean to use -i/--identity to specify a private key?")
+		}
 	default: // encrypt
 		if len(identityFlags) > 0 {
 			logFatalf("Error: -i/--identity can't be used in encryption mode.\n" +
 				"Did you forget to specify -d/--decrypt?")
 		}
-		if len(recipientFlags) == 0 && !passFlag {
+		if len(recipientFlags) == 0 && len(recipientsFileFlags) == 0 && !passFlag {
 			logFatalf("Error: missing recipients.\n" +
-				"Did you forget to specify -r/--recipient or -p/--passphrase?")
+				"Did you forget to specify -r/--recipient, -R/--recipients-file or -p/--passphrase?")
 		}
 		if len(recipientFlags) > 0 && passFlag {
 			logFatalf("Error: -p/--passphrase can't be combined with -r/--recipient.")
 		}
+		if len(recipientsFileFlags) > 0 && passFlag {
+			logFatalf("Error: -p/--passphrase can't be combined with -R/--recipients-file.")
+		}
 	}
 
-	var in, out io.ReadWriter = os.Stdin, os.Stdout
+	var in io.Reader = os.Stdin
+	var out io.Writer = os.Stdout
 	if name := flag.Arg(0); name != "" && name != "-" {
 		f, err := os.Open(name)
 		if err != nil {
@@ -125,26 +169,29 @@ func main() {
 		stdinInUse = true
 	}
 	if name := outFlag; name != "" && name != "-" {
-		f, err := os.OpenFile(name, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0666)
-		if err != nil {
-			logFatalf("Error: failed to open output file %q: %v", name, err)
+		if _, err := os.Stat(name); err == nil {
+			logFatalf("Error: output file %q exists", name)
 		}
+		f := newLazyOpener(name)
 		defer f.Close()
 		out = f
 	} else if terminal.IsTerminal(int(os.Stdout.Fd())) {
-		if armorFlag {
-			// If the output will go to a TTY, and it will be armored, buffer it
-			// up so it doesn't get in the way of typing the input.
+		if name != "-" {
+			if decryptFlag {
+				// TODO: buffer the output and check it's printable.
+			} else if !armorFlag {
+				// If the output wouldn't be armored, refuse to send binary to
+				// the terminal unless explicitly requested with "-o -".
+				logFatalf("Error: refusing to output binary to the terminal.\n" +
+					`Did you mean to use -a/--armor? Force with "-o -".`)
+			}
+		}
+		if in == os.Stdin && terminal.IsTerminal(int(os.Stdin.Fd())) {
+			// If the input comes from a TTY and output will go to a TTY,
+			// buffer it up so it doesn't get in the way of typing the input.
 			buf := &bytes.Buffer{}
 			defer func() { io.Copy(os.Stdout, buf) }()
 			out = buf
-		} else if decryptFlag && name != "-" {
-			// TODO: buffer the output and check it's printable.
-		} else if name != "-" {
-			// If the output wouldn't be armored, refuse to send binary to the
-			// terminal unless explicitly requested with "-o -".
-			logFatalf("Error: refusing to output binary to the terminal.\n" +
-				`Did you mean to use -a/--armor? Force with "-o -".`)
 		}
 	}
 
@@ -158,7 +205,7 @@ func main() {
 		}
 		encryptPass(pass, in, out, armorFlag)
 	default:
-		encryptKeys(recipientFlags, in, out, armorFlag)
+		encryptKeys(recipientFlags, recipientsFileFlags, in, out, armorFlag)
 	}
 }
 
@@ -189,7 +236,7 @@ func passphrasePromptForEncryption() (string, error) {
 	return p, nil
 }
 
-func encryptKeys(keys []string, in io.Reader, out io.Writer, armor bool) {
+func encryptKeys(keys, files []string, in io.Reader, out io.Writer, armor bool) {
 	var recipients []age.Recipient
 	for _, arg := range keys {
 		r, err := parseRecipient(arg)
@@ -198,6 +245,13 @@ func encryptKeys(keys []string, in io.Reader, out io.Writer, armor bool) {
 		}
 		recipients = append(recipients, r)
 	}
+	for _, name := range files {
+		recs, err := parseRecipientsFile(name)
+		if err != nil {
+			logFatalf("Error: failed to parse recipient file %q: %v", name, err)
+		}
+		recipients = append(recipients, recs...)
+	}
 	encrypt(recipients, in, out, armor)
 }
 
@@ -239,12 +293,12 @@ func decrypt(keys []string, in io.Reader, out io.Writer) {
 		&LazyScryptIdentity{passphrasePrompt},
 	}
 
-	// TODO: use the default location if no arguments are provided:
-	// os.UserConfigDir()/age/keys.txt, ~/.ssh/id_rsa, ~/.ssh/id_ed25519
+	// TODO: check the default SSH location if no arguments are provided
+	// (~/.ssh/id_rsa, ~/.ssh/id_ed25519).
 	for _, name := range keys {
 		ids, err := parseIdentitiesFile(name)
 		if err != nil {
-			logFatalf("Error: %v", err)
+			logFatalf("Error reading %q: %v", name, err)
 		}
 		identities = append(identities, ids...)
 	}
@@ -274,6 +328,33 @@ func passphrasePrompt() (string, error) {
 	return string(pass), nil
 }
 
+type lazyOpener struct {
+	name string
+	f    *os.File
+	err  error
+}
+
+func newLazyOpener(name string) io.WriteCloser {
+	return &lazyOpener{name: name}
+}
+
+func (l *lazyOpener) Write(p []byte) (n int, err error) {
+	if l.f == nil && l.err == nil {
+		l.f, l.err = os.OpenFile(l.name, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0666)
+	}
+	if l.err != nil {
+		return 0, l.err
+	}
+	return l.f.Write(p)
+}
+
+func (l *lazyOpener) Close() error {
+	if l.f != nil {
+		return l.f.Close()
+	}
+	return nil
+}
+
 func logFatalf(format string, v ...interface{}) {
 	_log.Printf(format, v...)
 	_log.Fatalf("[ Did age not do what you expected? Could an error be more useful?" +

cmd/age/age_test.go

@@ -19,14 +19,22 @@ import (
 func TestVectors(t *testing.T) {
 	files, _ := filepath.Glob("testdata/*.age")
 	for _, f := range files {
-		name := strings.TrimSuffix(strings.TrimPrefix(f, "testdata/"), ".age")
+		_, name := filepath.Split(f)
+		name = strings.TrimSuffix(name, ".age")
+		expectFailure := strings.HasPrefix(name, "fail_")
 		t.Run(name, func(t *testing.T) {
-			identities, err := parseIdentitiesFile("testdata/" + name + "_key.txt")
-			if err != nil {
-				t.Fatal(err)
+			var identities []age.Identity
+			ids, err := parseIdentitiesFile("testdata/" + name + "_key.txt")
+			if err == nil {
+				identities = append(identities, ids...)
 			}
-			for _, i := range identities {
-				t.Logf("%s", i.Type())
+			password, err := ioutil.ReadFile("testdata/" + name + "_password.txt")
+			if err == nil {
+				i, err := age.NewScryptIdentity(string(password))
+				if err != nil {
+					t.Fatal(err)
+				}
+				identities = append(identities, i)
 			}
 
 			in, err := os.Open("testdata/" + name + ".age")
@@ -34,14 +42,20 @@ func TestVectors(t *testing.T) {
 				t.Fatal(err)
 			}
 			r, err := age.Decrypt(in, identities...)
-			if err != nil {
-				t.Fatal(err)
+			if expectFailure {
+				if err == nil {
+					t.Fatal("expected Decrypt failure")
+				}
+			} else {
+				if err != nil {
+					t.Fatal(err)
+				}
+				out, err := ioutil.ReadAll(r)
+				if err != nil {
+					t.Fatal(err)
+				}
+				t.Logf("%s", out)
 			}
-			out, err := ioutil.ReadAll(r)
-			if err != nil {
-				t.Fatal(err)
-			}
-			t.Logf("%s", out)
 		})
 	}
 }

cmd/age/parse.go

@@ -8,15 +8,17 @@ package main
 
 import (
 	"bufio"
-	"bytes"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"io/ioutil"
+	"log"
 	"os"
 	"strings"
 
 	"filippo.io/age"
 	"filippo.io/age/agessh"
+	"golang.org/x/crypto/cryptobyte"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -31,53 +33,116 @@ func parseRecipient(arg string) (age.Recipient, error) {
 	return nil, fmt.Errorf("unknown recipient type: %q", arg)
 }
 
-const privateKeySizeLimit = 1 << 24 // 16 MiB
-
-func parseIdentitiesFile(name string) ([]age.Identity, error) {
-	f, err := os.Open(name)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open file: %v", err)
-	}
-	defer f.Close()
-
-	contents, err := ioutil.ReadAll(io.LimitReader(f, privateKeySizeLimit))
-	if err != nil {
-		return nil, fmt.Errorf("failed to read %q: %v", name, err)
-	}
-	if len(contents) == privateKeySizeLimit {
-		return nil, fmt.Errorf("failed to read %q: file too long", name)
+func parseRecipientsFile(name string) ([]age.Recipient, error) {
+	var f *os.File
+	if name == "-" {
+		if stdinInUse {
+			return nil, fmt.Errorf("standard input is used for multiple purposes")
+		}
+		stdinInUse = true
+		f = os.Stdin
+	} else {
+		var err error
+		f, err = os.Open(name)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open recipient file: %v", err)
+		}
+		defer f.Close()
 	}
 
-	var ids []age.Identity
-	var ageParsingError error
-	scanner := bufio.NewScanner(bytes.NewReader(contents))
+	const recipientFileSizeLimit = 16 << 20 // 16 MiB
+	const lineLengthLimit = 8 << 10         // 8 KiB, same as sshd(8)
+	var recs []age.Recipient
+	scanner := bufio.NewScanner(io.LimitReader(f, recipientFileSizeLimit))
+	var n int
 	for scanner.Scan() {
+		n++
 		line := scanner.Text()
 		if strings.HasPrefix(line, "#") || line == "" {
 			continue
 		}
-		if strings.HasPrefix(line, "-----BEGIN") {
-			return parseSSHIdentity(name, contents)
+		if len(line) > lineLengthLimit {
+			return nil, fmt.Errorf("%q: line %d is too long", name, n)
 		}
-		if ageParsingError != nil {
-			continue
-		}
-		i, err := age.ParseX25519Identity(line)
+		r, err := parseRecipient(line)
 		if err != nil {
-			ageParsingError = fmt.Errorf("malformed secret keys file %q: %v", name, err)
-			continue
+			if t, ok := sshKeyType(line); ok {
+				// Skip unsupported but valid SSH public keys with a warning.
+				log.Printf("Warning: recipients file %q: ignoring unsupported SSH key of type %q at line %d", name, t, n)
+				continue
+			}
+			// Hide the error since it might unintentionally leak the contents
+			// of confidential files.
+			return nil, fmt.Errorf("%q: malformed recipient at line %d", name, n)
 		}
-		ids = append(ids, i)
+		recs = append(recs, r)
 	}
 	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("failed to read %q: %v", name, err)
+		return nil, fmt.Errorf("%q: failed to read recipients file: %v", name, err)
 	}
-	if ageParsingError != nil {
-		return nil, ageParsingError
+	if len(recs) == 0 {
+		return nil, fmt.Errorf("%q: no recipients found", name)
+	}
+	return recs, nil
+}
+
+func sshKeyType(s string) (string, bool) {
+	// TODO: also ignore options? And maybe support multiple spaces and tabs as
+	// field separators like OpenSSH?
+	fields := strings.Split(s, " ")
+	if len(fields) < 2 {
+		return "", false
+	}
+	key, err := base64.StdEncoding.DecodeString(fields[1])
+	if err != nil {
+		return "", false
+	}
+	k := cryptobyte.String(key)
+	var typeLen uint32
+	var typeBytes []byte
+	if !k.ReadUint32(&typeLen) || !k.ReadBytes(&typeBytes, int(typeLen)) {
+		return "", false
+	}
+	if t := fields[0]; t == string(typeBytes) {
+		return t, true
+	}
+	return "", false
+}
+
+func parseIdentitiesFile(name string) ([]age.Identity, error) {
+	var f *os.File
+	if name == "-" {
+		if stdinInUse {
+			return nil, fmt.Errorf("standard input is used for multiple purposes")
+		}
+		stdinInUse = true
+		f = os.Stdin
+	} else {
+		var err error
+		f, err = os.Open(name)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open file: %v", err)
+		}
+		defer f.Close()
 	}
 
-	if len(ids) == 0 {
-		return nil, fmt.Errorf("no secret keys found in %q", name)
+	b := bufio.NewReader(f)
+	const pemHeader = "-----BEGIN"
+	if peeked, _ := b.Peek(len(pemHeader)); string(peeked) == pemHeader {
+		const privateKeySizeLimit = 1 << 14 // 16 KiB
+		contents, err := ioutil.ReadAll(io.LimitReader(b, privateKeySizeLimit))
+		if err != nil {
+			return nil, fmt.Errorf("failed to read %q: %v", name, err)
+		}
+		if len(contents) == privateKeySizeLimit {
+			return nil, fmt.Errorf("failed to read %q: file too long", name)
+		}
+		return parseSSHIdentity(name, contents)
+	}
+
+	ids, err := age.ParseIdentities(b)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read %q: %v", name, err)
 	}
 	return ids, nil
 }
@@ -114,11 +179,16 @@ func parseSSHIdentity(name string, pemBytes []byte) ([]age.Identity, error) {
 }
 
 func readPubFile(name string) (ssh.PublicKey, error) {
+	if name == "-" {
+		return nil, fmt.Errorf(`failed to obtain public key for "-" SSH key
+
+Use a file for which the corresponding ".pub" file exists, or convert the private key to a modern format with "ssh-keygen -p -m RFC4716"`)
+	}
 	f, err := os.Open(name + ".pub")
 	if err != nil {
 		return nil, fmt.Errorf(`failed to obtain public key for %q SSH key: %v
 
-    Ensure %q exists, or convert the private key %q to a modern format with "ssh-keygen -p -m RFC4716"`, name, err, name+".pub", name)
+Ensure %q exists, or convert the private key %q to a modern format with "ssh-keygen -p -m RFC4716"`, name, err, name+".pub", name)
 	}
 	defer f.Close()
 	contents, err := ioutil.ReadAll(f)

cmd/age/testdata/fail_large_filekey_scrypt.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> scrypt qeKad+OgIkBbr/ndSa7J3Q 1
+C2tmV7/uZjRafxqaQd1JhYkM2KxuHHBy3/d2dJNEZEh8rZCqYfvE/eJUXqiqZsZa
+6kWgG1qa6Q6sXPz0vIIpYHGf4gzxG9oTVonMke2kHC4
+--- FQeacPQobvFBd0tuIQnQDd/NEDR4G4MfylkXiq9ZqZ0
+Ãù€pÛÂt€t�˜Ë3qòÆ)¬ÌÈŒv´¨QÆoÌšK÷¶7ÜØ)ø%a

cmd/age/testdata/fail_large_filekey_scrypt_password.txt

@@ -0,0 +1 @@
+dog-old-little-breeze-novel-razor-battle-replace-lake-horse

cmd/age/testdata/fail_large_filekey_x25519.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> X25519 /Gt0E6JT7yuYHlwsGW5LbpEEJawOc+QMeMAS+hoOIgw
+XU/4Zkz4MksDhge0kosiMTJF8tHnOP0ZSi+6aaMqLMS1PlMIs95nKz3H7JGesTwA
+tsxuQrj+TuoGouNB1O0VshA9vsHGurn0Dtw5e7bkw9Q
+--- jQNSF6blozj2QFYJ/2iqy0wUcPuz/8vCS7RgKH8wjNI
+Þ9­¶‡yË_£§R\¯ÿm\¥û©Uv6Qȶ»ñmK»a¢©êv®©˜2

cmd/age/testdata/fail_large_filekey_x25519_key.txt

@@ -0,0 +1,3 @@
+# created: 2020-09-19T18:42:11+02:00
+# public key: age1uc8zlurjyjpenrslc2thyl28u7ylz6x8c2g9yphvjha6xm8ppf3slq0l25
+AGE-SECRET-KEY-1D8JAD8SXNFVQEFHAUNNAX4QCE3K5CUKMT7YYHNGTUSSP97YGWL4STV89UH

go.mod

@@ -3,6 +3,7 @@ module filippo.io/age
 go 1.13
 
 require (
+	filippo.io/edwards25519 v1.0.0-alpha.2
 	github.com/sergi/go-diff v1.1.0
 	golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59
 )

go.sum

@@ -1,3 +1,5 @@
+filippo.io/edwards25519 v1.0.0-alpha.2 h1:EWbZLqGEPSIj2W69gx04KtNVkyPIfe3uj0DhDQJonbQ=
+filippo.io/edwards25519 v1.0.0-alpha.2/go.mod h1:X+pm78QAUPtFLi1z9PYIlS/bdDnvbCOGKtZ+ACWEf7o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/bech32/bech32_test.go

@@ -43,7 +43,7 @@ func TestBech32(t *testing.T) {
 		{"split1a2y9w", false},      // too short data part
 		{"1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", false}, // empty hrp
 		// invalid character (DEL) in hrp
-		{"spl" + string(127) + "t1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", false},
+		{"spl" + string(rune(127)) + "t1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", false},
 		// too long
 		{"11qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqc8247j", false},
 

internal/format/format.go

@@ -55,29 +55,33 @@ func NewlineWriter(dst io.Writer) io.Writer {
 type newlineWriter struct {
 	dst     io.Writer
 	written int
+	buf     bytes.Buffer
 }
 
-func (w *newlineWriter) Write(p []byte) (n int, err error) {
+func (w *newlineWriter) Write(p []byte) (int, error) {
+	if w.buf.Len() != 0 {
+		panic("age: internal error: non-empty newlineWriter.buf")
+	}
 	for len(p) > 0 {
 		remainingInLine := ColumnsPerLine - (w.written % ColumnsPerLine)
 		if remainingInLine == ColumnsPerLine && w.written != 0 {
-			if _, err := w.dst.Write([]byte("\n")); err != nil {
-				return n, err
-			}
+			w.buf.Write([]byte("\n"))
 		}
 		toWrite := remainingInLine
 		if toWrite > len(p) {
 			toWrite = len(p)
 		}
-		nn, err := w.dst.Write(p[:toWrite])
-		n += nn
-		w.written += nn
-		p = p[nn:]
-		if err != nil {
-			return n, err
-		}
+		n, _ := w.buf.Write(p[:toWrite])
+		w.written += n
+		p = p[n:]
 	}
-	return n, nil
+	if _, err := w.buf.WriteTo(w.dst); err != nil {
+		// We always return n = 0 on error because it's hard to work back to the
+		// input length that ended up written out. Not ideal, but Write errors
+		// are not recoverable anyway.
+		return 0, err
+	}
+	return len(p), nil
 }
 
 const intro = "age-encryption.org/v1\n"

internal/stream/stream.go

@@ -74,7 +74,7 @@ func (r *Reader) Read(p []byte) (int, error) {
 	return n, nil
 }
 
-// readChunk reads the next chunk of ciphertext from r.c and makes it available
+// readChunk reads the next chunk of ciphertext from r.src and makes it available
 // in r.unread. last is true if the chunk was marked as the end of the message.
 // readChunk must not be called again after returning a last chunk or an error.
 func (r *Reader) readChunk() (last bool, err error) {

parse.go

@@ -0,0 +1,86 @@
+// Copyright 2021 Google LLC
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+package age
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// ParseIdentities parses a file with one or more private key encodings, one per
+// line. Empty lines and lines starting with "#" are ignored.
+//
+// This is the same syntax as the private key files accepted by the CLI, except
+// the CLI also accepts SSH private keys, which are not recommended for the
+// average application.
+//
+// Currently, all returned values are of type *X25519Identity, but different
+// types might be returned in the future.
+func ParseIdentities(f io.Reader) ([]Identity, error) {
+	const privateKeySizeLimit = 1 << 24 // 16 MiB
+	var ids []Identity
+	scanner := bufio.NewScanner(io.LimitReader(f, privateKeySizeLimit))
+	var n int
+	for scanner.Scan() {
+		n++
+		line := scanner.Text()
+		if strings.HasPrefix(line, "#") || line == "" {
+			continue
+		}
+		i, err := ParseX25519Identity(line)
+		if err != nil {
+			return nil, fmt.Errorf("error at line %d: %v", n, err)
+		}
+		ids = append(ids, i)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("failed to read secret keys file: %v", err)
+	}
+	if len(ids) == 0 {
+		return nil, fmt.Errorf("no secret keys found")
+	}
+	return ids, nil
+}
+
+// ParseRecipients parses a file with one or more public key encodings, one per
+// line. Empty lines and lines starting with "#" are ignored.
+//
+// This is the same syntax as the recipients files accepted by the CLI, except
+// the CLI also accepts SSH recipients, which are not recommended for the
+// average application.
+//
+// Currently, all returned values are of type *X25519Recipient, but different
+// types might be returned in the future.
+func ParseRecipients(f io.Reader) ([]Recipient, error) {
+	const recipientFileSizeLimit = 1 << 24 // 16 MiB
+	var recs []Recipient
+	scanner := bufio.NewScanner(io.LimitReader(f, recipientFileSizeLimit))
+	var n int
+	for scanner.Scan() {
+		n++
+		line := scanner.Text()
+		if strings.HasPrefix(line, "#") || line == "" {
+			continue
+		}
+		r, err := ParseX25519Recipient(line)
+		if err != nil {
+			// Hide the error since it might unintentionally leak the contents
+			// of confidential files.
+			return nil, fmt.Errorf("malformed recipient at line %d", n)
+		}
+		recs = append(recs, r)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("failed to read recipients file: %v", err)
+	}
+	if len(recs) == 0 {
+		return nil, fmt.Errorf("no recipients found")
+	}
+	return recs, nil
+}

primitives.go

@@ -9,6 +9,7 @@ package age
 import (
 	"crypto/hmac"
 	"crypto/sha256"
+	"fmt"
 	"io"
 
 	"filippo.io/age/internal/format"
@@ -16,6 +17,7 @@ import (
 	"golang.org/x/crypto/hkdf"
 )
 
+// aeadEncrypt encrypts a message with a one-time key.
 func aeadEncrypt(key, plaintext []byte) ([]byte, error) {
 	aead, err := chacha20poly1305.New(key)
 	if err != nil {
@@ -30,11 +32,19 @@ func aeadEncrypt(key, plaintext []byte) ([]byte, error) {
 	return aead.Seal(nil, nonce, plaintext, nil), nil
 }
 
-func aeadDecrypt(key, ciphertext []byte) ([]byte, error) {
+// aeadDecrypt decrypts a message of an expected fixed size.
+//
+// The message size is limited to mitigate multi-key attacks, where a ciphertext
+// can be crafted that decrypts successfully under multiple keys. Short
+// ciphertexts can only target two keys, which has limited impact.
+func aeadDecrypt(key []byte, size int, ciphertext []byte) ([]byte, error) {
 	aead, err := chacha20poly1305.New(key)
 	if err != nil {
 		return nil, err
 	}
+	if len(ciphertext) != size+aead.Overhead() {
+		return nil, fmt.Errorf("encrypted message has unexpected length")
+	}
 	nonce := make([]byte, chacha20poly1305.NonceSize)
 	return aead.Open(nil, nonce, ciphertext, nil)
 }

scrypt.go

@@ -19,7 +19,8 @@ import (
 
 const scryptLabel = "age-encryption.org/v1/scrypt"
 
-// ScryptRecipient is a password-based recipient.
+// ScryptRecipient is a password-based recipient. Anyone with the password can
+// decrypt the message.
 //
 // If a ScryptRecipient is used, it must be the only recipient for the file: it
 // can't be mixed with other recipient types and can't be used multiple times
@@ -60,8 +61,10 @@ func (r *ScryptRecipient) SetWorkFactor(logN int) {
 	r.workFactor = logN
 }
 
+const scryptSaltSize = 16
+
 func (r *ScryptRecipient) Wrap(fileKey []byte) (*Stanza, error) {
-	salt := make([]byte, 16)
+	salt := make([]byte, scryptSaltSize)
 	if _, err := rand.Read(salt[:]); err != nil {
 		return nil, err
 	}
@@ -133,7 +136,7 @@ func (i *ScryptIdentity) Unwrap(block *Stanza) ([]byte, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse scrypt salt: %v", err)
 	}
-	if len(salt) != 16 {
+	if len(salt) != scryptSaltSize {
 		return nil, errors.New("invalid scrypt recipient block")
 	}
 	logN, err := strconv.Atoi(block.Args[1])
@@ -153,7 +156,14 @@ func (i *ScryptIdentity) Unwrap(block *Stanza) ([]byte, error) {
 		return nil, fmt.Errorf("failed to generate scrypt hash: %v", err)
 	}
 
-	fileKey, err := aeadDecrypt(k, block.Body)
+	// This AEAD is not robust, so an attacker could craft a message that
+	// decrypts under two different keys (meaning two different passphrases) and
+	// then use an error side-channel in an online decryption oracle to learn if
+	// either key is correct. This is deemed acceptable because the usa case (an
+	// online decryption oracle) is not recommended, and the security loss is
+	// only one bit. This also does not bypass any scrypt work, but that work
+	// can be precomputed in an online oracle scenario.
+	fileKey, err := aeadDecrypt(k, fileKeySize, block.Body)
 	if err != nil {
 		return nil, ErrIncorrectIdentity
 	}

testdata/example.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> X25519 8hrlM+ZBG3Dd4fF2+a583zdTIWDk8/R41kCYZsvwTW4
+yO4PYdlMWDJ+CxgUNRqY5Z0T/m+g3FCh5jIxGLbCVXc
+--- I/imevZzy8120JSzmJnmn/KMk3p5A11V83Nk41m9NPE
+pĹĺ6$ˇRSů,ZŃʲsşMa€wč8 AzňĘ"rČř\…w4ˇ1;u鍯

testdata/keys.txt

@@ -0,0 +1,2 @@
+# Test key for ExampleParseX25519Identities.
+AGE-SECRET-KEY-184JMZMVQH3E6U0PSL869004Y3U2NYV7R30EU99CSEDNPH02YUVFSZW44VU

x25519.go

@@ -23,7 +23,11 @@ import (
 
 const x25519Label = "age-encryption.org/v1/X25519"
 
-// X25519Recipient is the standard age public key, based on a Curve25519 point.
+// X25519Recipient is the standard age public key. Messages encrypted to this
+// recipient can be decrypted with the corresponding X25519Identity.
+//
+// This recipient is anonymous, in the sense that an attacker can't tell from
+// the message alone if it is encrypted to a certain recipient.
 type X25519Recipient struct {
 	theirPublicKey []byte
 }
@@ -105,7 +109,8 @@ func (r *X25519Recipient) String() string {
 	return s
 }
 
-// X25519Identity is the standard age private key, based on a Curve25519 scalar.
+// X25519Identity is the standard age private key, which can decrypt messages
+// encrypted to the corresponding X25519Recipient.
 type X25519Identity struct {
 	secretKey, ourPublicKey []byte
 }
@@ -136,19 +141,19 @@ func GenerateX25519Identity() (*X25519Identity, error) {
 	return newX25519IdentityFromScalar(secretKey)
 }
 
-// ParseX25519Identity returns a new X25519Recipient from a Bech32 private key
+// ParseX25519Identity returns a new X25519Identity from a Bech32 private key
 // encoding with the "AGE-SECRET-KEY-1" prefix.
 func ParseX25519Identity(s string) (*X25519Identity, error) {
 	t, k, err := bech32.Decode(s)
 	if err != nil {
-		return nil, fmt.Errorf("malformed secret key %q: %v", s, err)
+		return nil, fmt.Errorf("malformed secret key: %v", err)
 	}
 	if t != "AGE-SECRET-KEY-" {
-		return nil, fmt.Errorf("malformed secret key %q: invalid type %q", s, t)
+		return nil, fmt.Errorf("malformed secret key: unknown type %q", t)
 	}
 	r, err := newX25519IdentityFromScalar(k)
 	if err != nil {
-		return nil, fmt.Errorf("malformed secret key %q: %v", s, err)
+		return nil, fmt.Errorf("malformed secret key: %v", err)
 	}
 	return r, nil
 }
@@ -182,7 +187,7 @@ func (i *X25519Identity) Unwrap(block *Stanza) ([]byte, error) {
 		return nil, err
 	}
 
-	fileKey, err := aeadDecrypt(wrappingKey, block.Body)
+	fileKey, err := aeadDecrypt(wrappingKey, fileKeySize, block.Body)
 	if err != nil {
 		return nil, ErrIncorrectIdentity
 	}