Recipients from age-plugin-fido2prf?

[gabyx]

Hello as a security noob I was a bit confused why age-plugin-yubikey generates a recipient on the console, but
age-plugin-fido2prf does not?

also a age-keygen -y does not work with an identity from age-plugin-fido2prf.

Is that actually possible.
I know that age -e -i age-fido2.txt works, but a recipient would be much better =)

[FiloSottile]

age-plugin-fido2prf is a symmetric plugin, so there is no recipient separate from the identity, age -e -i is indeed how you're meant to encrypt to it. We could probably explain it better! Would a message on the terminal have helped?

age-keygen -y support would not be possible at the moment (even if a recipient existed), see FiloSottile/age#666.

[gabyx]

Jeah a comment on the cli wpuld hae helped :)!

[gabyx]

@FiloSottile I thought that I could use this plugin cause it seemed nice since all cheaper Yubikeys have the fido2 protocol and not PIV as the more expensive one, also they use this NIST curve and not ed2559 etc
Hm...

What is a bit special is that I thought age can only encrypt for multiple recipients but it can also do that for identities. This never became clear really. Is that true? cause I could
age -e -i fido2 -r age....

[gabyx]

@FiloSottile Also right, the fido age identity is a private key which one should not share altough it only works together with the Yubikey?

[gabyx]

@FiloSottile So its correct that this plugin is symmetric encryption

and this one https://github.com/olastor/age-plugin-fido2-hmac
is asymmetric encryption.

I should have use probably the later one right?