FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
https://age-encryption.org
BSD 3-Clause "New" or "Revised" License
15.95k stars 482 forks source link

UX: Try passphrase on multiple identities #210

Closed ElvishJerricco closed 3 years ago

ElvishJerricco commented 3 years ago

What were you trying to do

Decrypt a file in a script without knowing who will be entering the passphrase.

What happened

age does not support trying multiple identities when decrypting a file. E.G. a file was encrypted with --recipients-file <(cat alice.pub bob.pub). A script that runs automatically on boot uses age -d -i alice.priv -i bob.priv. It might be either Alice or Bob who is present to enter the passphrase for their private key; the system does not know which. It should try the passphrase on both private keys so that decryption will succeed no matter which one of them is present.