Age: Simple File Encryption Tool

Today I learned about age. This is a turnkey file encryption format and tool/library that uses hybrid encryption. Unlike PGP, it is specialized for file encryption.

Quick hands-on steps:

# 1. Create a secret file
echo "The king has donkey's ears." > secret.txt

# 2. Generate the key pair
age-keygen -o key.txt

# 3. Encrypt the secret file
age -r <PUBLIC_KEY> -o secret.txt.age secret.txt

# 4. Decrypt the secret file
age -d -i key.txt secret.txt.age

Instead of generating a new key pair with age like the above, an SSH key pair, or even a passphrase can also be used for encryption/decryption.

An encrypted file can be generated for multiple key pairs by passing multiple recipient public keys. If my wife and my son give me their public key, I can generate a single encrypted file they both can decrypt.

age-keygen -o key1.txt
age-keygen -o key2.txt

# Encrypt for two recipients
age -r <PUBLIC_KEY of key1.txt> -r <PUBLIC_KEY of key2.txt> -o secret.txt.age secret.txt

# Decrypt with key1.txt
age -d -i key1.txt secret.txt.age

# Decrypt with key2.txt
age -d -i key2.txt secret.txt.age

Age encrypts the file with symmetric encryption (ChaCha20-Poly1305) with a file key, and encrypts the file key with a wrapping key derived using X25519 key agreement for each recipient (> 0), and bundles the encrypted keys with the encrypted payload.

The encrypted file would look like this.

age-encryption.org/v1
-> X25519 9p1g7VAuV0cko2lpvAgHUerS3RE4eYpyOeR48JU6iBg
1aTcruAvPBChjiwRBq6F4HQbhcOWoKqyC6g9bmhsdUg
-> X25519 wQ+Ogz6GrybDFFLe0TpcYfvq8Var4tXrvpgH3Y/rE1c
lt0mHvllhryXG4H2JfiTq7HtrRfbXZNGI8yyUXYXqLQ
--- JearPj0CWS3jifMPL7SgDCPEgBij1XH53f//wSQy67A
(binary data goes here...)

There are two lines that start with -> X25519 .... That line is the beginning of a stanza, which contains the information needed by that recipient to recover the file key.

Age also supports post-quantum hybrid native keys, designed to remain secure against future cryptographically relevant quantum computers, in addition to classic X25519 keys.