Replacing passphrase with biometry

[anjos]

I was wondering if it would be possible to use a age plugin such as age-plugin-se to replace the passphrase locking the decryption key associated with my gopass repo. Is it?

[dominikschulz]

There should be some level of support for age plugins, but I haven't verified that myself. Maybe someone else can chime in on this.

[AnomalRoil]

It is true that we do support plugin recipients and identities since #2960, but we do not support using a plugin for decrypting our identity keyring file for the age backend...

I considered changing

gopass/internal/backend/crypto/age/decrypt.go

Lines 53 to 77 in 2c268d2

	// decryptFile is used to decrypt a scrypt encrypted age keyring/identity file.
	func (a *Age) decryptFile(ctx context.Context, filename string) ([]byte, error) {
	ciphertext, err := os.ReadFile(filename)
	if err != nil {
	return nil, err
	}
	debug.Log("read %d bytes from %s", len(ciphertext), filename)
	pw, err := ctxutil.GetPasswordCallback(ctx)(filename, false)
	if err != nil {
	return nil, err
	}
	id, err := age.NewScryptIdentity(string(pw))
	if err != nil {
	return nil, err
	}
	plaintext, err := a.decrypt(ciphertext, id)
	if err != nil {
	ctxutil.GetPasswordPurgeCallback(ctx)(filename)
	}
	return plaintext, err
	}

to support plugin identities when working on #2960, but it proved much more complicated than I initially thought, since Age expects us to pass it the right identities and won't "prompt" us for a scrypt identity if it needs one.
Meaning there is no good way for us to support that, short of adding a config option in which one could specify the identity they want to use for decrypting the identity keyring file, and if none is specified, then use scrypt. That could be an option. Happy to implement it if you feel it's the right approach.

[anjos]

Thanks for the answer!