Filippo Valsorda 20f9e8574f agessh,tag/tagtest: handle recipient hint collisions ...

The four-byte SSH fingerprints (and tagged recipient tags) are hints to
avoid unnecessary password prompts or hardware interactions. Treat an
authenticated unwrap failure after a hint match as a false positive and
continue looking for a matching stanza.

Without this, a colliding recipient stanza that appears before the
valid stanza makes decryption fail even though the file is correctly
encrypted to the identity. Any password prompt or hardware interaction
has already happened by then.

Reported by Claude, Anthropic's AI assistant, and triaged by the
Anthropic security team in collaboration with Anthropic Research,
as ANT-2026-S9C25K8W.

2026-08-29 19:30:10 +02:00

..

age-plugin-tagtest

tag/internal/age-plugin-tagtest: add plugin for testing tag recipients

2025-12-22 19:41:12 +01:00

tagtest

agessh,tag/tagtest: handle recipient hint collisions

2026-08-29 19:30:10 +02:00