AgePony 5.0.0

Keys that live in hardware, keys you can move to another phone or put on paper, and AgePony
in the share sheet.

5.0.0 also carries everything planned for 4.3.0, which never shipped on its own: signed
files that plain age can read, and a fix for a crash on passphrase files made with a high
work factor.

Added

• Share sheet and text selection. Share text or files into AgePony from any app. It sees
  whether what you shared is already encrypted and opens decrypt or encrypt to match.
  Shared files are read straight from the app that shared them and nothing is copied into
  AgePony's storage. Select text in an app, pick AgePony from the ⋮ menu, encrypt it, and
  "Replace the selected text" puts the ciphertext back in place. Apps that only let AgePony
  read the selection get a note to copy and paste instead. Encrypted results share straight
  out. Decrypted text can be shared too, after a warning that it leaves AgePony. (#14)
• Hardware decryption keys. Identities > Generate > Hardware decryption key creates a
  P-256 key inside the phone's secure hardware (StrongBox when the phone has one, otherwise
  the TEE). It is published as an age 1.3 age1tag1... recipient, so the age command line
  (1.3 or later) can encrypt to your phone with no plugin. Quantum-safe by default: the
  age1tagpq1... form adds ML-KEM-768, held in your vault, on top of the hardware P-256
  half. You can require your fingerprint or device PIN for each decrypt. That's off by
  default, because Android deletes keys like this if the screen lock is ever removed.
  Creating one needs Android 12 or later.
• Encrypt to age 1.3 tag recipients. Paste an age1tag1... or age1tagpq1... key as a
  recipient. That covers newer age-plugin-yubikey, age-plugin-se and age-plugin-tpm keys.
• Decrypt with a YubiKey. Paste the AGE-PLUGIN-YUBIKEY-1... line from
  age-plugin-yubikey into Import identity and tap the YubiKey once so AgePony can read the
  key in that slot. After that, files encrypted to it (older piv-p256 and newer p256tag)
  decrypt over NFC with a tap, plus the PIN when the slot requires it. AgePony only asks for
  a tap when the file is actually addressed to that key. 4.2.0 could encrypt to a YubiKey but
  not decrypt, and the YubiKey report in #10 is why this was on the list.
• Move keys to another phone. Settings > Send keys / Receive keys. The receiving phone
  shows a one-time post-quantum key as a QR code, the sending phone encrypts your
  identities, recipients and trusted signers to it, and both screens show the same short
  code so you can confirm you scanned the right phone. With both phones on the same Wi-Fi
  (or one on the other's hotspot) the keys go straight across in a few seconds, using
  RelayPony's local transfer protocol. The QR code carries the receiving phone's address,
  so nothing scans the network, and only encrypted data crosses it. The sending phone
  shows Sent only once the receiving phone has opened the transfer. Without shared Wi-Fi
  there's a file route instead. Either way the transfer is an ordinary age file: age -d
  with the receiving key gives a standard age identity file. Hardware keys stay on the
  phone they were made on.
• Paper backup. Open an age identity and choose Paper backup to get a printable PDF with
  a QR code and the text. By default the page is protected with a passphrase and is itself
  an ordinary age file, so it restores in AgePony (Settings > Restore from a paper backup)
  or with age -d on a computer. A plain, unprotected page is available for people who keep
  it in a safe.
• Passphrase work without unlocking. The lock screen has "Continue without unlocking" for
  encrypting or decrypting text with a passphrase and decrypting passphrase files. The vault
  stays locked and none of its keys are touched. A share that arrives while AgePony is
  locked gets the same option. (#13)

Changed

• Signed files are plain age files again. Encrypt-and-sign used to wrap the file and its
  signature together inside the ciphertext, so decrypting with the age command line gave
  back the wrapper instead of your file. The signature now travels in an extra, encrypted
  stanza in the age header. Plain age -d ignores it and returns the original bytes;
  AgePony reads it and verifies the signer, who is still hidden from anyone who can't
  decrypt. Signed files from 4.x still open and verify. (#11, surfaced by testing on #10)
• Software keys are tried before hardware keys. When a file is encrypted to both a
  hardware key and a normal one, AgePony opens it with the normal key without asking for a
  tap or a prompt. A cancelled prompt or an invalidated hardware key no longer blocks a file
  another key in your vault can open.
• Wiping the vault removes AgePony's keys from the Keystore too. That covers a reset and
  the duress password. Removing an identity from Recently deleted also deletes its Keystore
  key. Before this, hardware signing keys stayed in the Keystore after they were gone from
  the vault.

Fixed

• Passphrase files with a high work factor crashed the app. Some tools (rage, for one)
  pick the scrypt work factor by benchmarking the computer, and a fast desktop can choose
  2^20 or more, which needs over a gigabyte of memory to open. AgePony tried anyway, and
  opening such a file as a file closed the app without a word. It now checks the memory
  needed before starting and says clearly when a phone can't open that file, the same way
  for text and files. (#12)
• A one-time age1yubikey1... recipient in the recipient picker was rejected. It was
  sent to the X25519 parser. It is accepted now, along with the new tag recipients.

Deliberate limits

• Hardware keys can't be moved or backed up. That is what makes them hardware keys. The
  create screen says so, and suggests encrypting important files to a second recipient.
• YubiKey decrypt is NFC only. USB-C YubiKeys need a smart card layer AgePony doesn't
  have yet.
• Replace works only where the other app allows it. Some apps let AgePony read selected
  text but won't take a replacement back. AgePony tells you when that happens.
• Paper backup covers age keys only. SSH keys aren't included.
• A passphrase-encrypted signed file keeps the old wrapped format. The age spec requires a
  passphrase stanza to be alone in the header, so the signature can't ride along there.

Permissions

• One new permission, ACCESS_NETWORK_STATE. Android grants it at install without a
  prompt. It lets the key transfer keep its connection on Wi-Fi so it never goes over mobile
  data. No location, nearby devices or Bluetooth permission is needed. The receiving phone
  only listens while the Receive keys screen is open, and only accepts the sender holding
  the one-time code from its QR.

Compatibility

• Plain age reads everything AgePony writes. Checked against the age 1.3 command line:
  signed files, post-quantum age1pq1 files in both directions, tag recipients in both
  directions (with age's own test plugin), and key transfers. Paper backups are ordinary
  passphrase (scrypt) age files.
• Vault. Upgrading keeps every identity, recipient and note. Once a vault holds one of
  the new key types (hardware decryption key, YubiKey), a version older than 5.0.0 can't
  open it.
• F-Droid gets everything. Every change is in src/main and agepony-core, so the foss
  flavor carries the whole release.

versionCode 16, versionName 5.0.0.

Verifying this build

This release is reproducible. Two independent builds from clean clones of the v5.0.0 tag
are byte-identical, and the published APK matches them; the same check runs in F-Droid's
clean room.

• Content hash (signatures ignored, for reproducible-build verification): 5e508ed75e2a7d3187060d4fc36bc9ee60d0553ac4ff462116327e3e9cb9c062
• Whole-file SHA-256 of the download: ebfb258e58fa17e182cd634f290f197f11871f690e5a11552bfe19ebed3403c0 (also in AgePony-5.0.0-foss.apk.sha256)
• Signature: AgePony-5.0.0-foss.apk.asc, made with the NorseHorse release key, the same key
  F-Droid distributes.

The foss APK is the F-Droid build; it installs over an F-Droid copy with no uninstall.