Release 0.3.4

We don't know how to correctly use these identities. In particular, some
identities store parts of their private key material in certificate
extensions to work around hardware limitations. Not understanding these
extensions could lead to encrypting with the wrong protocol and
violating security assumptions.

.github/workflows/ci.yml

@@ -105,7 +105,7 @@ jobs:
         with:
           args: --release --timeout 180 --out Xml
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3.1.0
+        uses: codecov/codecov-action@v3.1.1
         with:
           token: ${{secrets.CODECOV_TOKEN}}
 

.github/workflows/release.yml

@@ -17,7 +17,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        name: [linux, windows, macos]
+        name:
+          - linux
+          - macos-arm64
+          - macos-x86_64
+          - windows
         include:
           - name: linux
             os: ubuntu-18.04
@@ -31,7 +35,14 @@ jobs:
             archive_name: age-plugin-yubikey.zip
             asset_suffix: x86_64-windows.zip
 
-          - name: macos
+          - name: macos-arm64
+            os: macos-latest
+            target: aarch64-apple-darwin
+            build_flags: --target aarch64-apple-darwin
+            archive_name: age-plugin-yubikey.tar.gz
+            asset_suffix: arm64-darwin.tar.gz
+
+          - name: macos-x86_64
             os: macos-latest
             archive_name: age-plugin-yubikey.tar.gz
             asset_suffix: x86_64-darwin.tar.gz
@@ -76,12 +87,10 @@ jobs:
         if: matrix.name == 'windows'
 
       - name: Upload archive to release
-        uses: svenstaro/upload-release-action@2.2.1
+        uses: svenstaro/upload-release-action@2.3.0
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: ${{ matrix.archive_name }}
           asset_name: age-plugin-yubikey-$tag-${{ matrix.asset_suffix }}
-          tag: ${{ github.ref }}
           prerelease: true
         if: github.event.inputs.test != 'true'
 
@@ -137,11 +146,9 @@ jobs:
           args: --package age-plugin-yubikey --no-build --target ${{ matrix.target }}
 
       - name: Upload Debian package to release
-        uses: svenstaro/upload-release-action@2.2.1
+        uses: svenstaro/upload-release-action@2.3.0
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: target/${{ matrix.target }}/debian/*.deb
-          tag: ${{ github.ref }}
           file_glob: true
           prerelease: true
         if: github.event.inputs.test != 'true'

CHANGELOG.md

@@ -8,6 +8,41 @@ to 0.3.0 are beta releases.
 
 ## [Unreleased]
 
+## [0.3.4] - 2026-04-08
+### Fixed
+- `age-plugin-yubikey` now completely ignores any identity that has unrecognised
+  critical extensions in its certificate, to ensure it doesn't misuse a newer
+  identity type.
+
+## [0.3.3] - 2023-02-11
+### Fixed
+- When `age-plugin-yubikey` assists the user in changing their PIN from the
+  default PIN, it no longer tells the user that PINs shorter than 6 characters
+  are allowed, and instead loops until the user enters a PIN of valid length.
+  It also now prevents the user from setting their PIN to the default PIN, to
+  avoid creating a cycle.
+- More kinds of SmartCard readers are ignored when they have no SmartCard
+  inserted.
+
+## [0.3.2] - 2023-01-01
+### Changed
+- The "sharing violation" logic now also sends SIGHUP to any `yubikey-agent`
+  that is running, to have them release any YubiKey locks they are holding.
+
+### Fixed
+- The "sharing violation" logic now runs during plugin mode as intended. In the
+  previous release it only ran during direct `age-plugin-yubikey` usage.
+
+## [0.3.1] - 2022-12-30
+### Changed
+- If a "sharing violation" error is encountered while opening a connection to a
+  YubiKey, and `scdaemon` is running (which can hold exclusive access to a
+  YubiKey indefinitely), `age-plugin-yubikey` now attempts to stop `scdaemon` by
+  interrupting it (or killing it on Windows), and then tries again to open the
+  connection.
+- Several error messages were enhanced with guidance on how to resolve their
+  respective issue.
+
 ## [0.3.0] - 2022-05-02
 First non-beta release!
 

Cargo.lock

@@ -49,7 +49,7 @@ dependencies = [
 
 [[package]]
 name = "age-plugin-yubikey"
-version = "0.3.0"
+version = "0.3.4"
 dependencies = [
  "age-core",
  "age-plugin",
@@ -71,6 +71,7 @@ dependencies = [
  "rand",
  "rust-embed",
  "sha2 0.9.9",
+ "sysinfo",
  "which",
  "x509",
  "x509-parser",
@@ -246,6 +247,12 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "396de984970346b0d9e93d1415082923c679e5ae5c3ee3dcbd104f5610af126b"
 
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.2"
@@ -264,6 +271,49 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
+dependencies = [
+ "autocfg 1.1.0",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "crypto-bigint"
 version = "0.2.11"
@@ -808,6 +858,15 @@ version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
 
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -834,6 +893,15 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "ntapi"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28774a7fd2fbb4f0babd8237ce554b73af68021b5f695a3cebd6c59bac0980f"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.3"
@@ -1154,6 +1222,28 @@ dependencies = [
  "getrandom",
 ]
 
+[[package]]
+name = "rayon"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db3a213adf02b3bcfd2d3846bb41cb22857d131789e01df434fb7e7bc0759b7"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cac410af5d00ab6884528b4ab69d1e8e146e8d471201800fa1b4524126de6ad3"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.2.11"
@@ -1426,6 +1516,21 @@ dependencies = [
  "unicode-xid",
 ]
 
+[[package]]
+name = "sysinfo"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49086f670c15221b510c3f8c47e04e49714c56820d5ca78e2f58419e9fbb0f1b"
+dependencies = [
+ "cfg-if",
+ "core-foundation-sys",
+ "libc",
+ "ntapi",
+ "once_cell",
+ "rayon",
+ "winapi",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.3.0"

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "age-plugin-yubikey"
 description = "YubiKey plugin for age clients"
-version = "0.3.0"
+version = "0.3.4"
 authors = ["Jack Grigg <thestr4d@gmail.com>"]
 repository = "https://github.com/str4d/age-plugin-yubikey"
 readme = "README.md"
@@ -9,6 +9,7 @@ keywords = ["age", "cli", "encryption", "yubikey"]
 categories = ["command-line-utilities", "cryptography"]
 license = "MIT OR Apache-2.0"
 edition = "2021"
+rust-version = "1.56" # MSRV
 
 [package.metadata.deb]
 extended-description = """\
@@ -46,6 +47,9 @@ i18n-embed-fl = "0.6"
 lazy_static = "1"
 rust-embed = "6"
 
+# GnuPG coexistence
+sysinfo = ">=0.26, <0.26.4"
+
 [dev-dependencies]
 flate2 = "1"
 man = "0.3"

README.md

@@ -18,6 +18,15 @@ cargo install age-plugin-yubikey
 
 Help from new packagers is very welcome.
 
+### Linux, BSD, etc.
+
+On non-Windows, non-macOS systems, you need to ensure that the `pcscd` service
+is installed and running. On Debian or Ubuntu, you can do this with:
+
+```
+$ sudo apt-get install pcscd
+```
+
 ### Windows Subsystem for Linux (WSL)
 
 WSL does not currently provide native support for USB devices. However, Windows

i18n/en-US/age_plugin_yubikey.ftl

@@ -12,6 +12,7 @@
 -yubikey = YubiKey
 -yubikeys = YubiKeys
 -age-plugin-yubikey = age-plugin-yubikey
+-pcscd = pcscd
 
 ## CLI commands and flags
 
@@ -126,13 +127,15 @@ mgr-change-default-pin =
     ✨ Your {-yubikey} is using the default PIN. Let's change it!
     ✨ We'll also set the PUK equal to the PIN.
 
-    🔐 The PIN is up to 8 numbers, letters, or symbols. Not just numbers!
+    🔐 The PIN can be numbers, letters, or symbols. Not just numbers!
+    📏 The PIN must be at least 6 and at most 8 characters in length.
     ❌ Your keys will be lost if the PIN and PUK are locked after 3 incorrect tries.
 
 mgr-enter-current-puk = Enter current PUK (default is {$default_puk})
 mgr-choose-new-pin    = Choose a new PIN/PUK
 mgr-repeat-new-pin    = Repeat the PIN/PUK
 mgr-pin-mismatch      = PINs don't match
+mgr-nope-default-pin  = You entered the default PIN again. You need to change it.
 
 mgr-changing-mgmt-key =
     ✨ Your {-yubikey} is using the default management key.
@@ -169,10 +172,16 @@ plugin-err-pin-required     = A PIN is required for {-yubikey} with serial {$yub
 
 ## Errors
 
-err-custom-mgmt-key      = Custom unprotected management keys are not supported.
+err-custom-mgmt-key = Custom unprotected non-TDES management keys are not supported.
+rec-custom-mgmt-key =
+    You can use the {-yubikey} Manager CLI to change to a protected management key:
+    {"  "}{$cmd}
+
+    See here for more information about {-yubikey} Manager:
+    {"  "}{$url}
+
 err-invalid-flag-command = Flag '{$flag}' cannot be used with '{$command}'.
 err-invalid-flag-tui     = Flag '{$flag}' cannot be used with the interactive interface.
-err-invalid-pin-length   = The PIN needs to be 1-8 characters.
 err-invalid-pin-policy   = Invalid PIN policy '{$policy}' (expected [{$expected}]).
 err-invalid-slot         = Invalid slot '{$slot}' (expected number between 1 and 20).
 err-invalid-touch-policy = Invalid touch policy '{$policy}' (expected [{$expected}]).
@@ -185,6 +194,22 @@ err-slot-has-no-identity = Slot {$slot} does not contain an {-age} identity or c
 err-slot-is-not-empty    = Slot {$slot} is not empty. Use {-flag-force} to overwrite the slot.
 err-timed-out            = Timed out while waiting for a {-yubikey} to be inserted.
 err-use-list-for-single  = Use {-cmd-list} to print the recipient for a single slot.
+
+err-yk-no-service-macos = The Crypto Token Kit service is not running.
+rec-yk-no-service-macos =
+    You may need to restart it. See this Stack Exchange answer for more help:
+    {"  "}{$url}
+
+err-yk-no-service-pcscd = {-pcscd} is not running.
+rec-yk-no-service-pcscd =
+    If you are on Debian or Ubuntu, you can install it with:
+    {"  "}{$apt}
+
+err-yk-no-service-win = The Smart Cards for Windows service is not running.
+rec-yk-no-service-win =
+    See this troubleshooting guide for more help:
+    {"  "}{$url}
+
 err-yk-not-found         = Please insert the {-yubikey} you want to set up
 err-yk-wrong-pin         = Invalid PIN ({$tries} tries remaining before it is blocked)
 err-yk-general           = Error while communicating with {-yubikey}: {$err}

src/builder.rs

@@ -1,7 +1,7 @@
 use rand::{rngs::OsRng, RngCore};
 use x509::RelativeDistinguishedName;
 use yubikey::{
-    certificate::{Certificate, PublicKeyInfo},
+    certificate::Certificate,
     piv::{generate as yubikey_generate, AlgorithmId, RetiredSlotId, SlotId},
     Key, PinPolicy, TouchPolicy, YubiKey,
 };
@@ -106,12 +106,7 @@ impl IdentityBuilder {
             touch_policy,
         )?;
 
-        let recipient = match &generated {
+        let recipient = Recipient::from_spki(&generated).expect("YubiKey generates a valid pubkey");
-            PublicKeyInfo::EcP256(pubkey) => {
-                Recipient::from_encoded(pubkey).expect("YubiKey generates a valid pubkey")
-            }
-            _ => unreachable!(),
-        };
         let stub = Stub::new(yubikey.serial(), slot, &recipient);
 
         // Pick a random serial for the new self-signed certificate.
@@ -139,7 +134,6 @@ impl IdentityBuilder {
             )],
         )?;
 
-        let (_, cert) = x509_parser::parse_x509_certificate(cert.as_ref()).unwrap();
         let metadata = Metadata::extract(yubikey, slot, &cert, false).unwrap();
 
         Ok((

src/error.rs

@@ -1,4 +1,3 @@
-use i18n_embed_fl::fl;
 use std::fmt;
 use std::io;
 use yubikey::{piv::RetiredSlotId, Serial};
@@ -9,13 +8,15 @@ macro_rules! wlnfl {
     ($f:ident, $message_id:literal) => {
         writeln!($f, "{}", $crate::fl!($message_id))
     };
+    ($f:ident, $message_id:literal, $($kwarg:expr),* $(,)*) => {{
+        writeln!($f, "{}", $crate::fl!($message_id, $($kwarg,)*))
+    }};
 }
 
 pub enum Error {
     CustomManagementKey,
     InvalidFlagCommand(String, String),
     InvalidFlagTui(String),
-    InvalidPinLength,
     InvalidPinPolicy(String),
     InvalidSlot(u8),
     InvalidTouchPolicy(String),
@@ -48,125 +49,74 @@ impl From<yubikey::Error> for Error {
 impl fmt::Debug for Error {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            Error::CustomManagementKey => wlnfl!(f, "err-custom-mgmt-key")?,
+            Error::CustomManagementKey => {
-            Error::InvalidFlagCommand(flag, command) => writeln!(
+                wlnfl!(f, "err-custom-mgmt-key")?;
+                let cmd = "ykman piv access change-management-key --protect";
+                let url = "https://developers.yubico.com/yubikey-manager/";
+                wlnfl!(f, "rec-custom-mgmt-key", cmd = cmd, url = url)?;
+            }
+            Error::InvalidFlagCommand(flag, command) => wlnfl!(
                 f,
-                "{}",
+                "err-invalid-flag-command",
-                fl!(
+                flag = flag.as_str(),
-                    crate::LANGUAGE_LOADER,
+                command = command.as_str(),
-                    "err-invalid-flag-command",
-                    flag = flag.as_str(),
-                    command = command.as_str(),
-                ),
             )?,
-            Error::InvalidFlagTui(flag) => writeln!(
+            Error::InvalidFlagTui(flag) => wlnfl!(f, "err-invalid-flag-tui", flag = flag.as_str())?,
+            Error::InvalidPinPolicy(s) => wlnfl!(
                 f,
-                "{}",
+                "err-invalid-pin-policy",
-                fl!(
+                policy = s.as_str(),
-                    crate::LANGUAGE_LOADER,
+                expected = "always, once, never",
-                    "err-invalid-flag-tui",
-                    flag = flag.as_str(),
-                ),
             )?,
-            Error::InvalidPinLength => wlnfl!(f, "err-invalid-pin-length")?,
+            Error::InvalidSlot(slot) => wlnfl!(f, "err-invalid-slot", slot = slot)?,
-            Error::InvalidPinPolicy(s) => writeln!(
+            Error::InvalidTouchPolicy(s) => wlnfl!(
                 f,
-                "{}",
+                "err-invalid-touch-policy",
-                fl!(
+                policy = s.as_str(),
-                    crate::LANGUAGE_LOADER,
+                expected = "always, cached, never",
-                    "err-invalid-pin-policy",
-                    policy = s.as_str(),
-                    expected = "always, once, never",
-                ),
-            )?,
-            Error::InvalidSlot(slot) => writeln!(
-                f,
-                "{}",
-                fl!(crate::LANGUAGE_LOADER, "err-invalid-slot", slot = slot),
-            )?,
-            Error::InvalidTouchPolicy(s) => writeln!(
-                f,
-                "{}",
-                fl!(
-                    crate::LANGUAGE_LOADER,
-                    "err-invalid-touch-policy",
-                    policy = s.as_str(),
-                    expected = "always, cached, never",
-                ),
-            )?,
-            Error::Io(e) => writeln!(
-                f,
-                "{}",
-                fl!(crate::LANGUAGE_LOADER, "err-io", err = e.to_string()),
             )?,
+            Error::Io(e) => wlnfl!(f, "err-io", err = e.to_string())?,
             Error::MultipleCommands => wlnfl!(f, "err-multiple-commands")?,
             Error::MultipleYubiKeys => wlnfl!(f, "err-multiple-yubikeys")?,
-            Error::NoEmptySlots(serial) => writeln!(
+            Error::NoEmptySlots(serial) => {
-                f,
+                wlnfl!(f, "err-no-empty-slots", serial = serial.to_string())?
-                "{}",
+            }
-                fl!(
+            Error::NoMatchingSerial(serial) => {
-                    crate::LANGUAGE_LOADER,
+                wlnfl!(f, "err-no-matching-serial", serial = serial.to_string())?
-                    "err-no-empty-slots",
+            }
-                    serial = serial.to_string(),
+            Error::SlotHasNoIdentity(slot) => {
-                ),
+                wlnfl!(f, "err-slot-has-no-identity", slot = slot_to_ui(slot))?
-            )?,
+            }
-            Error::NoMatchingSerial(serial) => writeln!(
+            Error::SlotIsNotEmpty(slot) => {
-                f,
+                wlnfl!(f, "err-slot-is-not-empty", slot = slot_to_ui(slot))?
-                "{}",
+            }
-                fl!(
-                    crate::LANGUAGE_LOADER,
-                    "err-no-matching-serial",
-                    serial = serial.to_string(),
-                ),
-            )?,
-            Error::SlotHasNoIdentity(slot) => writeln!(
-                f,
-                "{}",
-                fl!(
-                    crate::LANGUAGE_LOADER,
-                    "err-slot-has-no-identity",
-                    slot = slot_to_ui(slot),
-                ),
-            )?,
-            Error::SlotIsNotEmpty(slot) => writeln!(
-                f,
-                "{}",
-                fl!(
-                    crate::LANGUAGE_LOADER,
-                    "err-slot-is-not-empty",
-                    slot = slot_to_ui(slot),
-                ),
-            )?,
             Error::TimedOut => wlnfl!(f, "err-timed-out")?,
             Error::UseListForSingleSlot => wlnfl!(f, "err-use-list-for-single")?,
             Error::YubiKey(e) => match e {
                 yubikey::Error::NotFound => wlnfl!(f, "err-yk-not-found")?,
-                yubikey::Error::WrongPin { tries } => writeln!(
+                yubikey::Error::PcscError {
-                    f,
+                    inner: Some(pcsc::Error::NoService),
-                    "{}",
+                } => {
-                    fl!(crate::LANGUAGE_LOADER, "err-yk-wrong-pin", tries = tries),
+                    if cfg!(windows) {
-                )?,
+                        wlnfl!(f, "err-yk-no-service-win")?;
+                        let url = "https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-debugging-information#smart-card-service";
+                        wlnfl!(f, "rec-yk-no-service-win", url = url)?;
+                    } else if cfg!(target_os = "macos") {
+                        wlnfl!(f, "err-yk-no-service-macos")?;
+                        let url = "https://apple.stackexchange.com/a/438198";
+                        wlnfl!(f, "rec-yk-no-service-macos", url = url)?;
+                    } else {
+                        wlnfl!(f, "err-yk-no-service-pcscd")?;
+                        let apt = "sudo apt-get install pcscd";
+                        wlnfl!(f, "rec-yk-no-service-pcscd", apt = apt)?;
+                    }
+                }
+                yubikey::Error::WrongPin { tries } => wlnfl!(f, "err-yk-wrong-pin", tries = tries)?,
                 e => {
-                    writeln!(
+                    wlnfl!(f, "err-yk-general", err = e.to_string())?;
-                        f,
-                        "{}",
-                        fl!(
-                            crate::LANGUAGE_LOADER,
-                            "err-yk-general",
-                            err = e.to_string(),
-                        ),
-                    )?;
                     use std::error::Error;
                     if let Some(inner) = e.source() {
-                        writeln!(
+                        wlnfl!(f, "err-yk-general-cause", inner_err = inner.to_string())?;
-                            f,
-                            "{}",
-                            fl!(
-                                crate::LANGUAGE_LOADER,
-                                "err-yk-general-cause",
-                                inner_err = inner.to_string(),
-                            ),
-                        )?;
                     }
                 }
             },

src/key.rs

@@ -3,22 +3,24 @@
 use age_core::{
     format::{FileKey, FILE_KEY_BYTES},
     primitives::{aead_decrypt, hkdf},
-    secrecy::ExposeSecret,
+    secrecy::{ExposeSecret, SecretString},
 };
 use age_plugin::{identity, Callbacks};
 use bech32::{ToBase32, Variant};
 use dialoguer::Password;
-use log::warn;
+use log::{debug, error, warn};
+use std::convert::Infallible;
 use std::fmt;
 use std::io;
 use std::iter;
 use std::thread::sleep;
 use std::time::{Duration, Instant, SystemTime};
+use x509_parser::der_parser::oid::Oid;
 use yubikey::{
-    certificate::{Certificate, PublicKeyInfo},
+    certificate::Certificate,
     piv::{decrypt_data, AlgorithmId, RetiredSlotId, SlotId},
     reader::{Context, Reader},
-    MgmKey, PinPolicy, Serial, TouchPolicy, YubiKey,
+    Key, MgmKey, PinPolicy, Serial, TouchPolicy, YubiKey,
 };
 
 use crate::{
@@ -26,38 +28,32 @@ use crate::{
     fl,
     format::{RecipientLine, STANZA_KEY_LABEL},
     p256::{Recipient, TAG_BYTES},
-    util::{otp_serial_prefix, Metadata},
+    util::{otp_serial_prefix, Metadata, POLICY_EXTENSION_OID},
     IDENTITY_PREFIX,
 };
 
 const ONE_SECOND: Duration = Duration::from_secs(1);
 const FIFTEEN_SECONDS: Duration = Duration::from_secs(15);
 
+/// The set of OIDs that we understand and use when parsing YubiKey slot certificates.
+const KNOWN_OIDS: &[&[u64]] = &[POLICY_EXTENSION_OID];
+
 pub(crate) fn is_connected(reader: Reader) -> bool {
     filter_connected(&reader)
 }
 
 pub(crate) fn filter_connected(reader: &Reader) -> bool {
     match reader.open() {
-        Ok(_) => true,
+        Err(yubikey::Error::PcscError {
-        Err(e) => {
+            inner: Some(pcsc::Error::NoSmartcard | pcsc::Error::RemovedCard),
-            use std::error::Error;
+        }) => {
-            if let Some(pcsc::Error::RemovedCard) =
+            warn!(
-                e.source().and_then(|inner| inner.downcast_ref())
+                "{}",
-            {
+                fl!("warn-yk-not-connected", yubikey_name = reader.name())
-                warn!(
+            );
-                    "{}",
+            false
-                    i18n_embed_fl::fl!(
-                        crate::LANGUAGE_LOADER,
-                        "warn-yk-not-connected",
-                        yubikey_name = reader.name(),
-                    )
-                );
-                false
-            } else {
-                true
-            }
         }
+        _ => true,
     }
 }
 
@@ -77,16 +73,136 @@ pub(crate) fn wait_for_readers() -> Result<Context, Error> {
     }
 }
 
+/// Looks for agent processes that might be holding exclusive access to a YubiKey, and
+/// asks them as nicely as possible to release it.
+///
+/// Returns `true` if any known agent was running and was successfully interrupted (or
+/// killed if the platform doesn't support interrupts).
+fn hunt_agents() -> bool {
+    debug!("Sharing violation encountered, looking for agent processes");
+
+    use sysinfo::{ProcessExt, ProcessRefreshKind, RefreshKind, Signal, System, SystemExt};
+
+    let mut interrupted = false;
+
+    let sys =
+        System::new_with_specifics(RefreshKind::new().with_processes(ProcessRefreshKind::new()));
+
+    for process in sys.processes().values() {
+        match process.name() {
+            "scdaemon" | "scdaemon.exe" => {
+                // gpg-agent runs scdaemon to interact with smart cards. The canonical way
+                // to reload it is `gpgconf --reload scdaemon`, which kills and restarts
+                // the process. We emulate that here with SIGINT (which it listens to).
+                if process
+                    .kill_with(Signal::Interrupt)
+                    .unwrap_or_else(|| process.kill())
+                {
+                    debug!("Stopped scdaemon (PID {})", process.pid());
+                    interrupted = true;
+                }
+            }
+            "yubikey-agent" | "yubikey-agent.exe" => {
+                // yubikey-agent releases all YubiKey locks when it receives a SIGHUP.
+                match process.kill_with(Signal::Hangup) {
+                    Some(true) => {
+                        debug!("Sent SIGHUP to yubikey-agent (PID {})", process.pid());
+                        interrupted = true;
+                    }
+                    Some(false) => (),
+                    None => debug!(
+                        "Found yubikey-agent (PID {}) but platform doesn't support SIGHUP",
+                        process.pid(),
+                    ),
+                }
+            }
+            _ => (),
+        }
+    }
+
+    // If we did interrupt an agent, pause briefly to allow it to finish up.
+    if interrupted {
+        sleep(Duration::from_millis(100));
+    }
+
+    interrupted
+}
+
+fn open_sesame(
+    op: impl Fn() -> Result<YubiKey, yubikey::Error>,
+) -> Result<YubiKey, yubikey::Error> {
+    op().or_else(|e| match e {
+        yubikey::Error::PcscError {
+            inner: Some(pcsc::Error::SharingViolation),
+        } if hunt_agents() => op(),
+        _ => Err(e),
+    })
+}
+
+/// Opens a connection to this reader, returning a `YubiKey` if successful.
+///
+/// This is equivalent to [`Reader::open`], but additionally handles the presence of
+/// agents (which can indefinitely hold exclusive access to a YubiKey).
+pub(crate) fn open_connection(reader: &Reader) -> Result<YubiKey, yubikey::Error> {
+    open_sesame(|| reader.open())
+}
+
+/// Opens a YubiKey with a specific serial number.
+///
+/// This is equivalent to [`YubiKey::open_by_serial`], but additionally handles the
+/// presence of agents (which can indefinitely hold exclusive access to a YubiKey).
+fn open_by_serial(serial: Serial) -> Result<YubiKey, yubikey::Error> {
+    // `YubiKey::open_by_serial` has a bug where it ignores all opening errors, even if
+    // it potentially could have found a matching YubiKey if not for an error, and thus
+    // returns `Error::NotFound` if another agent is holding exclusive access to the
+    // required YubiKey. This gives misleading UX behaviour where age-plugin-yubikey asks
+    // the user to insert a YubiKey they have already inserted.
+    //
+    // For now, we instead implement the correct behaviour manually. Once MSRV has been
+    // raised to 1.60, we can upstream this into the `yubikey` crate.
+    open_sesame(|| {
+        let mut readers = Context::open()?;
+
+        let mut open_error = None;
+
+        for reader in readers.iter()? {
+            let yubikey = match reader.open() {
+                Ok(yk) => yk,
+                Err(e) => {
+                    // Save the first error we see that indicates we might have been able
+                    // to find a matching YubiKey.
+                    if open_error.is_none() {
+                        if let yubikey::Error::PcscError {
+                            inner: Some(pcsc::Error::SharingViolation),
+                        } = e
+                        {
+                            open_error = Some(e);
+                        }
+                    }
+                    continue;
+                }
+            };
+
+            if serial == yubikey.serial() {
+                return Ok(yubikey);
+            }
+        }
+
+        Err(if let Some(e) = open_error {
+            e
+        } else {
+            error!("no YubiKey detected with serial: {}", serial);
+            yubikey::Error::NotFound
+        })
+    })
+}
+
 pub(crate) fn open(serial: Option<Serial>) -> Result<YubiKey, Error> {
     if !Context::open()?.iter()?.any(is_connected) {
         if let Some(serial) = serial {
             eprintln!(
                 "{}",
-                i18n_embed_fl::fl!(
+                fl!("open-yk-with-serial", yubikey_serial = serial.to_string())
-                    crate::LANGUAGE_LOADER,
-                    "open-yk-with-serial",
-                    yubikey_serial = serial.to_string(),
-                )
             );
         } else {
             eprintln!("{}", fl!("open-yk-without-serial"));
@@ -99,9 +215,9 @@ pub(crate) fn open(serial: Option<Serial>) -> Result<YubiKey, Error> {
     // connected, an error is returned.
     let yubikey = match (readers_iter.next(), readers_iter.next(), serial) {
         (None, _, _) => unreachable!(),
-        (Some(reader), None, None) => reader.open()?,
+        (Some(reader), None, None) => open_connection(&reader)?,
         (Some(reader), None, Some(serial)) => {
-            let yubikey = reader.open()?;
+            let yubikey = open_connection(&reader)?;
             if yubikey.serial() != serial {
                 return Err(Error::NoMatchingSerial(serial));
             }
@@ -112,12 +228,12 @@ pub(crate) fn open(serial: Option<Serial>) -> Result<YubiKey, Error> {
                 .chain(Some(a))
                 .chain(Some(b))
                 .chain(readers_iter)
-                .find(|reader| match reader.open() {
+                .find(|reader| match open_connection(reader) {
                     Ok(yk) => yk.serial() == serial,
                     _ => false,
                 })
                 .ok_or(Error::NoMatchingSerial(serial))?;
-            reader.open()?
+            open_connection(&reader)?
         }
         (Some(_), Some(_), None) => return Err(Error::MultipleYubiKeys),
     };
@@ -125,14 +241,38 @@ pub(crate) fn open(serial: Option<Serial>) -> Result<YubiKey, Error> {
     Ok(yubikey)
 }
 
+fn request_pin<E>(
+    mut prompt: impl FnMut(Option<String>) -> io::Result<Result<SecretString, E>>,
+    serial: Serial,
+) -> io::Result<Result<SecretString, E>> {
+    let mut prev_error = None;
+    loop {
+        prev_error = Some(match prompt(prev_error)? {
+            Ok(pin) => match pin.expose_secret().len() {
+                // A PIN must be between 6 and 8 characters.
+                6..=8 => break Ok(Ok(pin)),
+                // If the string is 44 bytes and starts with the YubiKey's serial
+                // encoded as 12-byte modhex, the user probably touched the YubiKey
+                // early and "typed" an OTP.
+                44 if pin.expose_secret().starts_with(&otp_serial_prefix(serial)) => {
+                    fl!("plugin-err-accidental-touch")
+                }
+                // Otherwise, the PIN is either too short or too long.
+                0..=5 => fl!("plugin-err-pin-too-short"),
+                _ => fl!("plugin-err-pin-too-long"),
+            },
+            Err(e) => break Ok(Err(e)),
+        });
+    }
+}
+
 pub(crate) fn manage(yubikey: &mut YubiKey) -> Result<(), Error> {
     const DEFAULT_PIN: &str = "123456";
     const DEFAULT_PUK: &str = "12345678";
 
     eprintln!();
     let pin = Password::new()
-        .with_prompt(i18n_embed_fl::fl!(
+        .with_prompt(fl!(
-            crate::LANGUAGE_LOADER,
             "mgr-enter-pin",
             yubikey_serial = yubikey.serial().to_string(),
             default_pin = DEFAULT_PIN,
@@ -146,19 +286,30 @@ pub(crate) fn manage(yubikey: &mut YubiKey) -> Result<(), Error> {
         eprintln!("{}", fl!("mgr-change-default-pin"));
         eprintln!();
         let current_puk = Password::new()
-            .with_prompt(i18n_embed_fl::fl!(
+            .with_prompt(fl!("mgr-enter-current-puk", default_puk = DEFAULT_PUK))
-                crate::LANGUAGE_LOADER,
-                "mgr-enter-current-puk",
-                default_puk = DEFAULT_PUK,
-            ))
             .interact()?;
-        let new_pin = Password::new()
+        let new_pin = loop {
-            .with_prompt(fl!("mgr-choose-new-pin"))
+            let pin = request_pin(
-            .with_confirmation(fl!("mgr-repeat-new-pin"), fl!("mgr-pin-mismatch"))
+                |prev_error| {
-            .interact()?;
+                    if let Some(err) = prev_error {
-        if new_pin.len() > 8 {
+                        eprintln!("{}", err);
-            return Err(Error::InvalidPinLength);
+                    }
-        }
+                    Password::new()
+                        .with_prompt(fl!("mgr-choose-new-pin"))
+                        .with_confirmation(fl!("mgr-repeat-new-pin"), fl!("mgr-pin-mismatch"))
+                        .interact()
+                        .map(|pin| Result::<_, Infallible>::Ok(SecretString::new(pin)))
+                },
+                yubikey.serial(),
+            )?
+            .unwrap();
+            if pin.expose_secret() == DEFAULT_PIN {
+                eprintln!("{}", fl!("mgr-nope-default-pin"));
+            } else {
+                break pin;
+            }
+        };
+        let new_pin = new_pin.expose_secret();
         yubikey.change_puk(current_puk.as_bytes(), new_pin.as_bytes())?;
         yubikey.change_pin(pin.as_bytes(), new_pin.as_bytes())?;
     }
@@ -179,8 +330,7 @@ pub(crate) fn manage(yubikey: &mut YubiKey) -> Result<(), Error> {
         mgm_key.set_protected(yubikey).map_err(|e| {
             eprintln!(
                 "{}",
-                i18n_embed_fl::fl!(
+                fl!(
-                    crate::LANGUAGE_LOADER,
                     "mgr-changing-mgmt-key-error",
                     management_key = hex::encode(mgm_key.as_ref()),
                 )
@@ -193,6 +343,55 @@ pub(crate) fn manage(yubikey: &mut YubiKey) -> Result<(), Error> {
     Ok(())
 }
 
+/// Parses the certificate to identify the preferred recipient type it corresponds to.
+pub(crate) fn identify_recipient(cert: &Certificate) -> Option<Recipient> {
+    let known_oids = KNOWN_OIDS
+        .iter()
+        .map(|oid| Oid::from(oid).unwrap())
+        .collect::<Vec<_>>();
+
+    // If the certificate contains any unrecognised critical extensions, reject it: we
+    // don't know how to correctly use the identity. In particular, some identities store
+    // parts of their private key material in certificate extensions to work around
+    // hardware limitations. Not understanding these extensions could lead to encrypting
+    // with the wrong protocol and violating security assumptions.
+    let (_, c) = x509_parser::parse_x509_certificate(cert.as_ref()).ok()?;
+    if c.tbs_certificate
+        .extensions()
+        .iter()
+        .any(|ext| ext.critical && !known_oids.contains(&ext.oid))
+    {
+        return None;
+    }
+
+    Recipient::from_certificate(cert)
+}
+
+/// Returns an iterator of keys that are occupying plugin-compatible slots, along with the
+/// corresponding recipient if the key is compatible with this plugin.
+pub(crate) fn list_slots(
+    yubikey: &mut YubiKey,
+) -> Result<impl Iterator<Item = (Key, RetiredSlotId, Option<Recipient>)>, Error> {
+    Ok(Key::list(yubikey)?.into_iter().filter_map(|key| {
+        // We only use the retired slots.
+        match key.slot() {
+            SlotId::Retired(slot) => {
+                let recipient = identify_recipient(key.certificate());
+                Some((key, slot, recipient))
+            }
+            _ => None,
+        }
+    }))
+}
+
+/// Returns an iterator of keys that are compatible with this plugin.
+pub(crate) fn list_compatible(
+    yubikey: &mut YubiKey,
+) -> Result<impl Iterator<Item = (Key, RetiredSlotId, Recipient)>, Error> {
+    list_slots(yubikey)
+        .map(|iter| iter.filter_map(|(key, slot, res)| res.map(|recipient| (key, slot, recipient))))
+}
+
 /// A reference to an age key stored in a YubiKey.
 #[derive(Debug)]
 pub struct Stub {
@@ -272,14 +471,10 @@ impl Stub {
         &self,
         callbacks: &mut dyn Callbacks<E>,
     ) -> io::Result<Result<Option<Connection>, identity::Error>> {
-        let mut yubikey = match YubiKey::open_by_serial(self.serial) {
+        let mut yubikey = match open_by_serial(self.serial) {
             Ok(yk) => yk,
             Err(yubikey::Error::NotFound) => {
-                let mut message = i18n_embed_fl::fl!(
+                let mut message = fl!("plugin-insert-yk", yubikey_serial = self.serial.to_string());
-                    crate::LANGUAGE_LOADER,
-                    "plugin-insert-yk",
-                    yubikey_serial = self.serial.to_string(),
-                );
 
                 // If the `confirm` command is available, we loop until either the YubiKey
                 // we want is inserted, or the used explicitly skips.
@@ -294,14 +489,13 @@ impl Stub {
                         // User told us to skip this key.
                         Ok(false) => return Ok(Ok(None)),
                         // User said they plugged it in; try it.
-                        Ok(true) => match YubiKey::open_by_serial(self.serial) {
+                        Ok(true) => match open_by_serial(self.serial) {
                             Ok(yubikey) => break Some(yubikey),
                             Err(yubikey::Error::NotFound) => (),
                             Err(_) => {
                                 return Ok(Err(identity::Error::Identity {
                                     index: self.identity_index,
-                                    message: i18n_embed_fl::fl!(
+                                    message: fl!(
-                                        crate::LANGUAGE_LOADER,
                                         "plugin-err-yk-opening",
                                         yubikey_serial = self.serial.to_string(),
                                     ),
@@ -312,8 +506,7 @@ impl Stub {
                         Err(age_core::plugin::Error::Fail) => {
                             return Ok(Err(identity::Error::Identity {
                                 index: self.identity_index,
-                                message: i18n_embed_fl::fl!(
+                                message: fl!(
-                                    crate::LANGUAGE_LOADER,
                                     "plugin-err-yk-opening",
                                     yubikey_serial = self.serial.to_string(),
                                 ),
@@ -323,8 +516,7 @@ impl Stub {
 
                     // We're going to loop around, meaning that the first attempt failed.
                     // Change the message to indicate this to the user.
-                    message = i18n_embed_fl::fl!(
+                    message = fl!(
-                        crate::LANGUAGE_LOADER,
                         "plugin-insert-yk-retry",
                         yubikey_serial = self.serial.to_string(),
                     );
@@ -337,8 +529,7 @@ impl Stub {
                     if callbacks.message(&message)?.is_err() {
                         return Ok(Err(identity::Error::Identity {
                             index: self.identity_index,
-                            message: i18n_embed_fl::fl!(
+                            message: fl!(
-                                crate::LANGUAGE_LOADER,
                                 "plugin-err-yk-not-found",
                                 yubikey_serial = self.serial.to_string(),
                             ),
@@ -348,14 +539,13 @@ impl Stub {
                     // Start a 15-second timer waiting for the YubiKey to be inserted
                     let start = SystemTime::now();
                     loop {
-                        match YubiKey::open_by_serial(self.serial) {
+                        match open_by_serial(self.serial) {
                             Ok(yubikey) => break yubikey,
                             Err(yubikey::Error::NotFound) => (),
                             Err(_) => {
                                 return Ok(Err(identity::Error::Identity {
                                     index: self.identity_index,
-                                    message: i18n_embed_fl::fl!(
+                                    message: fl!(
-                                        crate::LANGUAGE_LOADER,
                                         "plugin-err-yk-opening",
                                         yubikey_serial = self.serial.to_string(),
                                     ),
@@ -367,8 +557,7 @@ impl Stub {
                             Ok(end) if end >= FIFTEEN_SECONDS => {
                                 return Ok(Err(identity::Error::Identity {
                                     index: self.identity_index,
-                                    message: i18n_embed_fl::fl!(
+                                    message: fl!(
-                                        crate::LANGUAGE_LOADER,
                                         "plugin-err-yk-timed-out",
                                         yubikey_serial = self.serial.to_string(),
                                     ),
@@ -382,8 +571,7 @@ impl Stub {
             Err(_) => {
                 return Ok(Err(identity::Error::Identity {
                     index: self.identity_index,
-                    message: i18n_embed_fl::fl!(
+                    message: fl!(
-                        crate::LANGUAGE_LOADER,
                         "plugin-err-yk-opening",
                         yubikey_serial = self.serial.to_string(),
                     ),
@@ -394,11 +582,10 @@ impl Stub {
         // Read the pubkey from the YubiKey slot and check it still matches.
         let (cert, pk) = match Certificate::read(&mut yubikey, SlotId::Retired(self.slot))
             .ok()
-            .and_then(|cert| match cert.subject_pki() {
+            .and_then(|cert| {
-                PublicKeyInfo::EcP256(pubkey) => Recipient::from_encoded(pubkey)
+                identify_recipient(&cert)
-                    .filter(|pk| pk.tag() == self.tag)
+                    .filter(|recipient| recipient.tag() == self.tag)
-                    .map(|pk| (cert, pk)),
+                    .map(|r| (cert, r))
-                _ => None,
             }) {
             Some(pk) => pk,
             None => {
@@ -444,9 +631,8 @@ impl Connection {
     ) -> io::Result<Result<(), identity::Error>> {
         // Check if we can skip requesting a PIN.
         if self.cached_metadata.is_none() {
-            let (_, cert) = x509_parser::parse_x509_certificate(self.cert.as_ref()).unwrap();
             self.cached_metadata =
-                match Metadata::extract(&mut self.yubikey, self.slot, &cert, true) {
+                match Metadata::extract(&mut self.yubikey, self.slot, &self.cert, true) {
                     None => {
                         return Ok(Err(identity::Error::Identity {
                             index: self.identity_index,
@@ -463,41 +649,30 @@ impl Connection {
         // The policy requires a PIN, so request it.
         // Note that we can't distinguish between PinPolicy::Once and PinPolicy::Always
         // because this plugin is ephemeral, so we always request the PIN.
-        let enter_pin_msg = i18n_embed_fl::fl!(
+        let pin = match request_pin(
-            crate::LANGUAGE_LOADER,
+            |prev_error| {
-            "plugin-enter-pin",
+                callbacks.request_secret(&format!(
-            yubikey_serial = self.yubikey.serial().to_string(),
+                    "{}{}{}",
-        );
+                    prev_error.as_deref().unwrap_or(""),
-        let mut message = enter_pin_msg.clone();
+                    prev_error.as_deref().map(|_| " ").unwrap_or(""),
-        let pin = loop {
+                    fl!(
-            message = match callbacks.request_secret(&message)? {
+                        "plugin-enter-pin",
-                Ok(pin) => match pin.expose_secret().len() {
+                        yubikey_serial = self.yubikey.serial().to_string(),
-                    // A PIN must be between 6 and 8 characters.
+                    )
-                    6..=8 => break pin,
+                ))
-                    // If the string is 44 bytes and starts with the YubiKey's serial
+            },
-                    // encoded as 12-byte modhex, the user probably touched the YubiKey
+            self.yubikey.serial(),
-                    // early and "typed" an OTP.
+        )? {
-                    44 if pin
+            Ok(pin) => pin,
-                        .expose_secret()
+            Err(_) => {
-                        .starts_with(&otp_serial_prefix(self.yubikey.serial())) =>
+                return Ok(Err(identity::Error::Identity {
-                    {
+                    index: self.identity_index,
-                        format!("{} {}", fl!("plugin-err-accidental-touch"), enter_pin_msg)
+                    message: fl!(
-                    }
+                        "plugin-err-pin-required",
-                    // Otherwise, the PIN is either too short or too long.
+                        yubikey_serial = self.yubikey.serial().to_string(),
-                    0..=5 => format!("{} {}", fl!("plugin-err-pin-too-short"), enter_pin_msg),
+                    ),
-                    _ => format!("{} {}", fl!("plugin-err-pin-too-long"), enter_pin_msg),
+                }))
-                },
+            }
-                Err(_) => {
-                    return Ok(Err(identity::Error::Identity {
-                        index: self.identity_index,
-                        message: i18n_embed_fl::fl!(
-                            crate::LANGUAGE_LOADER,
-                            "plugin-err-pin-required",
-                            yubikey_serial = self.yubikey.serial().to_string(),
-                        ),
-                    }))
-                }
-            };
         };
         if let Err(e) = self.yubikey.verify_pin(pin.expose_secret().as_bytes()) {
             return Ok(Err(identity::Error::Identity {

src/main.rs

@@ -12,12 +12,7 @@ use i18n_embed::{
 };
 use lazy_static::lazy_static;
 use rust_embed::RustEmbed;
-use yubikey::{
+use yubikey::{piv::RetiredSlotId, reader::Context, PinPolicy, Serial, TouchPolicy};
-    certificate::PublicKeyInfo,
-    piv::{RetiredSlotId, SlotId},
-    reader::Context,
-    Key, PinPolicy, Serial, TouchPolicy,
-};
 
 mod builder;
 mod error;
@@ -73,6 +68,9 @@ macro_rules! fl {
     ($message_id:literal) => {{
         i18n_embed_fl::fl!($crate::LANGUAGE_LOADER, $message_id)
     }};
+    ($message_id:literal, $($kwarg:expr),* $(,)*) => {{
+        i18n_embed_fl::fl!($crate::LANGUAGE_LOADER, $message_id, $($kwarg,)*)
+    }};
 }
 
 #[derive(Debug, Options)]
@@ -193,26 +191,12 @@ fn print_single(
 ) -> Result<(), Error> {
     let mut yubikey = key::open(serial)?;
 
-    let mut keys = Key::list(&mut yubikey)?.into_iter().filter_map(|key| {
+    let (key, slot, recipient) = key::list_compatible(&mut yubikey)?
-        // - We only use the retired slots.
-        // - Only P-256 keys are compatible with us.
-        match (key.slot(), key.certificate().subject_pki()) {
-            (SlotId::Retired(slot), PublicKeyInfo::EcP256(pubkey)) => {
-                p256::Recipient::from_encoded(pubkey).map(|r| (key, slot, r))
-            }
-            _ => None,
-        }
-    });
-
-    let (key, slot, recipient) = keys
         .find(|(_, s, _)| s == &slot)
         .ok_or(Error::SlotHasNoIdentity(slot))?;
 
     let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
-    let metadata = x509_parser::parse_x509_certificate(key.certificate().as_ref())
+    let metadata = util::Metadata::extract(&mut yubikey, slot, key.certificate(), true).unwrap();
-        .ok()
-        .and_then(|(_, cert)| util::Metadata::extract(&mut yubikey, slot, &cert, true))
-        .unwrap();
 
     printer(stub, recipient, metadata);
 
@@ -229,33 +213,16 @@ fn print_multiple(
 
     let mut printed = 0;
     for reader in readers.iter()?.filter(key::filter_connected) {
-        let mut yubikey = reader.open()?;
+        let mut yubikey = key::open_connection(&reader)?;
         if let Some(serial) = serial {
             if yubikey.serial() != serial {
                 continue;
             }
         }
 
-        for key in Key::list(&mut yubikey)? {
+        for (key, slot, recipient) in key::list_compatible(&mut yubikey)? {
-            // We only use the retired slots.
-            let slot = match key.slot() {
-                SlotId::Retired(slot) => slot,
-                _ => continue,
-            };
-
-            // Only P-256 keys are compatible with us.
-            let recipient = match key.certificate().subject_pki() {
-                PublicKeyInfo::EcP256(pubkey) => match p256::Recipient::from_encoded(pubkey) {
-                    Some(recipient) => recipient,
-                    None => continue,
-                },
-                _ => continue,
-            };
-
             let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
-            let metadata = match x509_parser::parse_x509_certificate(key.certificate().as_ref())
+            let metadata = match util::Metadata::extract(&mut yubikey, slot, key.certificate(), all)
-                .ok()
-                .and_then(|(_, cert)| util::Metadata::extract(&mut yubikey, slot, &cert, all))
             {
                 Some(res) => res,
                 None => continue,
@@ -268,15 +235,7 @@ fn print_multiple(
         println!();
     }
     if printed > 1 {
-        eprintln!(
+        eprintln!("{}", fl!("printed-multiple", kind = kind, count = printed));
-            "{}",
-            i18n_embed_fl::fl!(
-                LANGUAGE_LOADER,
-                "printed-multiple",
-                kind = kind,
-                count = printed,
-            )
-        );
     }
 
     Ok(())
@@ -382,8 +341,7 @@ fn main() -> Result<(), Error> {
 
         eprintln!(
             "{}",
-            i18n_embed_fl::fl!(
+            fl!(
-                LANGUAGE_LOADER,
                 "cli-setup-intro",
                 generate_usage = "age-plugin-yubikey --generate",
             )
@@ -401,9 +359,8 @@ fn main() -> Result<(), Error> {
         let reader_names = readers_list
             .iter()
             .map(|reader| {
-                reader.open().map(|yk| {
+                key::open_connection(reader).map(|yk| {
-                    i18n_embed_fl::fl!(
+                    fl!(
-                        LANGUAGE_LOADER,
                         "cli-setup-yk-name",
                         yubikey_name = reader.name(),
                         yubikey_serial = yk.serial().to_string(),
@@ -421,28 +378,25 @@ fn main() -> Result<(), Error> {
             None => return Ok(()),
         };
 
-        let keys = Key::list(&mut yubikey)?;
+        let keys = key::list_slots(&mut yubikey)?.collect::<Vec<_>>();
 
         // Identify slots that we can't allow the user to select.
         let slot_details: Vec<_> = USABLE_SLOTS
             .iter()
             .map(|&slot| {
                 keys.iter()
-                    .find(|key| key.slot() == SlotId::Retired(slot))
+                    .find(|(_, s, _)| s == &slot)
-                    .map(|key| match key.certificate().subject_pki() {
+                    .map(|(key, _, recipient)| {
-                        PublicKeyInfo::EcP256(pubkey) => {
+                        recipient.as_ref().map(|_| {
-                            p256::Recipient::from_encoded(pubkey).map(|_| {
+                            // Cache the details we need to display to the user.
-                                // Cache the details we need to display to the user.
+                            let (_, cert) =
-                                let (_, cert) =
+                                x509_parser::parse_x509_certificate(key.certificate().as_ref())
-                                    x509_parser::parse_x509_certificate(key.certificate().as_ref())
+                                    .unwrap();
-                                        .unwrap();
+                            let (name, _) = util::extract_name(&cert, true).unwrap();
-                                let (name, _) = util::extract_name(&cert, true).unwrap();
+                            let created = cert.validity().not_before.to_rfc2822();
-                                let created = cert.validity().not_before.to_rfc2822();
 
-                                format!("{}, created: {}", name, created)
+                            format!("{}, created: {}", name, created)
-                            })
+                        })
-                        }
-                        _ => None,
                     })
             })
             .collect();
@@ -455,20 +409,13 @@ fn main() -> Result<(), Error> {
                 let i = i + 1;
 
                 match occupied {
-                    Some(Some(name)) => i18n_embed_fl::fl!(
+                    Some(Some(name)) => fl!(
-                        LANGUAGE_LOADER,
                         "cli-setup-slot-usable",
                         slot_index = i,
                         slot_name = name.as_str(),
                     ),
-                    Some(None) => i18n_embed_fl::fl!(
+                    Some(None) => fl!("cli-setup-slot-unusable", slot_index = i),
-                        LANGUAGE_LOADER,
+                    None => fl!("cli-setup-slot-empty", slot_index = i),
-                        "cli-setup-slot-unusable",
-                        slot_index = i,
-                    ),
-                    None => {
-                        i18n_embed_fl::fl!(LANGUAGE_LOADER, "cli-setup-slot-empty", slot_index = i)
-                    }
                 }
             })
             .collect();
@@ -491,27 +438,17 @@ fn main() -> Result<(), Error> {
                 }
             };
 
-            if let Some(key) = keys.iter().find(|key| key.slot() == SlotId::Retired(slot)) {
+            if let Some((key, _, recipient)) = keys.into_iter().find(|(_, s, _)| s == &slot) {
-                let recipient = match key.certificate().subject_pki() {
+                let recipient = recipient.expect("We checked this above");
-                    PublicKeyInfo::EcP256(pubkey) => {
-                        p256::Recipient::from_encoded(pubkey).expect("We checked this above")
-                    }
-                    _ => unreachable!(),
-                };
 
                 if Confirm::new()
-                    .with_prompt(i18n_embed_fl::fl!(
+                    .with_prompt(fl!("cli-setup-use-existing", slot_index = slot_index))
-                        LANGUAGE_LOADER,
-                        "cli-setup-use-existing",
-                        slot_index = slot_index,
-                    ))
                     .interact()?
                 {
                     let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
-                    let (_, cert) =
-                        x509_parser::parse_x509_certificate(key.certificate().as_ref()).unwrap();
                     let metadata =
-                        util::Metadata::extract(&mut yubikey, slot, &cert, true).unwrap();
+                        util::Metadata::extract(&mut yubikey, slot, key.certificate(), true)
+                            .unwrap();
 
                     ((stub, recipient, metadata), false)
                 } else {
@@ -576,11 +513,7 @@ fn main() -> Result<(), Error> {
                 };
 
                 if Confirm::new()
-                    .with_prompt(i18n_embed_fl::fl!(
+                    .with_prompt(fl!("cli-setup-generate-new", slot_index = slot_index))
-                        LANGUAGE_LOADER,
-                        "cli-setup-generate-new",
-                        slot_index = slot_index,
-                    ))
                     .interact()?
                 {
                     eprintln!();
@@ -632,8 +565,7 @@ fn main() -> Result<(), Error> {
         writeln!(
             file,
             "{}",
-            i18n_embed_fl::fl!(
+            fl!(
-                LANGUAGE_LOADER,
                 "yubikey-identity",
                 yubikey_metadata = metadata.to_string(),
                 recipient = recipient.to_string(),
@@ -668,8 +600,7 @@ fn main() -> Result<(), Error> {
         eprintln!();
         eprintln!(
             "{}",
-            i18n_embed_fl::fl!(
+            fl!(
-                LANGUAGE_LOADER,
                 "cli-setup-finished",
                 is_new = if is_new { "true" } else { "false" },
                 recipient = recipient.to_string(),

src/p256.rs

@@ -1,6 +1,8 @@
 use bech32::{ToBase32, Variant};
 use p256::elliptic_curve::sec1::{FromEncodedPoint, ToEncodedPoint};
 use sha2::{Digest, Sha256};
+use yubikey::{certificate::PublicKeyInfo, Certificate};
+
 use std::fmt;
 
 use crate::RECIPIENT_PREFIX;
@@ -42,11 +44,22 @@ impl Recipient {
         }
     }
 
+    pub(crate) fn from_certificate(cert: &Certificate) -> Option<Self> {
+        Self::from_spki(cert.subject_pki())
+    }
+
+    pub(crate) fn from_spki(spki: &PublicKeyInfo) -> Option<Self> {
+        match spki {
+            PublicKeyInfo::EcP256(pubkey) => Self::from_encoded(pubkey),
+            _ => None,
+        }
+    }
+
     /// Attempts to parse a valid YubiKey recipient from its SEC-1 encoding.
     ///
     /// This accepts both compressed (as used by the plugin) and uncompressed (as used in
     /// the YubiKey certificate) encodings.
-    pub(crate) fn from_encoded(encoded: &p256::EncodedPoint) -> Option<Self> {
+    fn from_encoded(encoded: &p256::EncodedPoint) -> Option<Self> {
         p256::PublicKey::from_encoded_point(encoded).map(Recipient)
     }
 

src/plugin.rs

@@ -71,8 +71,7 @@ impl RecipientPluginV1 for RecipientPlugin {
                 Ok(Some(conn)) => yk_recipients.push(conn.recipient().clone()),
                 Ok(None) => yk_errors.push(recipient::Error::Identity {
                     index: stub.identity_index,
-                    message: i18n_embed_fl::fl!(
+                    message: fl!(
-                        crate::LANGUAGE_LOADER,
                         "plugin-err-yk-opening",
                         yubikey_serial = stub.serial.to_string(),
                     ),

src/util.rs

@@ -4,7 +4,7 @@ use std::iter;
 use x509_parser::{certificate::X509Certificate, der_parser::oid::Oid};
 use yubikey::{
     piv::{RetiredSlotId, SlotId},
-    PinPolicy, Serial, TouchPolicy, YubiKey,
+    Certificate, PinPolicy, Serial, TouchPolicy, YubiKey,
 };
 
 use crate::fl;
@@ -112,9 +112,11 @@ impl Metadata {
     pub(crate) fn extract(
         yubikey: &mut YubiKey,
         slot: RetiredSlotId,
-        cert: &X509Certificate,
+        cert: &Certificate,
         all: bool,
     ) -> Option<Self> {
+        let (_, cert) = x509_parser::parse_x509_certificate(cert.as_ref()).ok()?;
+
         // We store the PIN and touch policies for identities in their certificates
         // using the same certificate extension as PIV attestations.
         // https://developers.yubico.com/PIV/Introduction/PIV_attestation.html
@@ -143,10 +145,10 @@ impl Metadata {
                 .unwrap_or((None, None))
         };
 
-        extract_name(cert, all)
+        extract_name(&cert, all)
             .map(|(name, ours)| {
                 if ours {
-                    let (pin_policy, touch_policy) = policies(cert);
+                    let (pin_policy, touch_policy) = policies(&cert);
                     (name, pin_policy, touch_policy)
                 } else {
                     // We can extract the PIN and touch policies via an attestation. This
@@ -180,8 +182,7 @@ impl fmt::Display for Metadata {
         write!(
             f,
             "{}",
-            i18n_embed_fl::fl!(
+            fl!(
-                crate::LANGUAGE_LOADER,
                 "yubikey-metadata",
                 serial = self.serial.to_string(),
                 slot = slot_to_ui(&self.slot),
@@ -197,20 +198,13 @@ impl fmt::Display for Metadata {
 pub(crate) fn print_identity(stub: Stub, recipient: Recipient, metadata: Metadata) {
     let recipient = recipient.to_string();
     if !console::user_attended() {
-        eprintln!(
+        let recipient = recipient.as_str();
-            "{}",
+        eprintln!("{}", fl!("print-recipient", recipient = recipient));
-            i18n_embed_fl::fl!(
-                crate::LANGUAGE_LOADER,
-                "print-recipient",
-                recipient = recipient.as_str(),
-            )
-        );
     }
 
     println!(
         "{}",
-        i18n_embed_fl::fl!(
+        fl!(
-            crate::LANGUAGE_LOADER,
             "yubikey-identity",
             yubikey_metadata = metadata.to_string(),
             recipient = recipient,