search

str4d / age-plugin-yubikey

YubiKey plugin for age
Apache License 2.0
589 stars 25 forks source link

Feature: Yubikey Bio Series support? (if at all possible) #176

Open con-f-use opened 6 months ago

con-f-use commented 6 months ago

It seems that non-PIV enabled yubikeys like the Bio Series cannot be used with the age-plugin, correct? Is that fundamentally impossible? If not, I'd like to request support.

str4d commented 6 months ago

The current Bio series can't be supported, correct. The FIDO and FIDO2 protocols do not expose enough to support encryption.

I do see that there is a YubiKey Bio Series Multi-protocol Edition listed as "coming soon", and that should work as-is. The only question will be if the PIN and touch policies are more customizable given the biometric authentication; that might require some tweaking here to support properly.

con-f-use commented 6 months ago

From my experience with the regular bio, the fingerprint just replaces the regular touch, pin works the same on both serieses and is required in the same situations (which, together with the lack of PIV and NFC, imo makes the bio series way inferior, but that is another topic).