Using the 'age' file encryption tool to securely exchange a large sensitive file between two parties over a hostile network.

age-example.sh

#!/bin/bash

# Example of using the 'age' file encryption tool to securely exchange
# a large sensitive file between two parties over a hostile network.

# https://age-encryption.org/
# https://github.com/FiloSottile/age
# https://htmlpreview.github.io/?https://github.com/FiloSottile/age/blob/main/doc/age.1.html

###############################################################
# Sender has a large file to send, 2.6GB.
###############################################################

# The source file.
INPATH="ubuntu-24.04-live-server-amd64.iso"

ls -lh "$INPATH"
#-rw-r--r--@ 1 js  staff   2.6G Aug  7 09:47 ubuntu-24.04-live-server-amd64.iso
file "$INPATH"
#ubuntu-24.04-live-server-amd64.iso: ISO 9660 CD-ROM filesystem data (DOS/MBR boot sector) 'Ubuntu-Server 24.04 LTS amd64' (bootable)
sha256sum "$INPATH"
#8762f7e74e4d64d72fceb5f70682e6b069932deedb4949c6975d0f0fe0a91be3 ubuntu-24.04-live-server-amd64.iso


###############################################################
# Receiver generates a public key pair using Age,
# and sends the public key to Sender.
###############################################################

age-keygen -o private-key.txt
#Public key: age1qhltyq6d3r6q7v3daamw6ex6y7urtmjn0anpc677yeanqc80tcwqgh5yn9


###############################################################
# Sender uses the public key to compress and encrypt the file. 
# This can take some time.
###############################################################

OUTPATH="encrypted.tar.gz.age"

tar cvz $INPATH | age -r age1qhltyq6d3r6q7v3daamw6ex6y7urtmjn0anpc677yeanqc80tcwqgh5yn9 > $OUTPATH
#a ubuntu-24.04-live-server-amd64.iso

ls -lh $OUTPATH
#-rw-r--r--@ 1 js  staff   2.5G Aug  7 10:03 encrypted.tar.gz.age
file $OUTPATH
#encrypted.tar.gz.age: data
sha256sum $OUTPATH
#4f791caf801054a3f27d59a5aaaf3e14642a60255e37e490a55062765fe7e595  encrypted.tar.gz.age


###############################################################
# Sender cannot decrypt the file.
# Sender gives the encrypted file to Receiver.
# Receiver decrypts the file.
###############################################################


age --decrypt -i private-key.txt $OUTFILE > decrypted.tar.gz

ls -lh ubuntu-24.04-live-server-amd64.iso
#-rw-r--r--@ 1 js  staff   2.6G Aug  7 09:47 ubuntu-24.04-live-server-amd64.iso
file ubuntu-24.04-live-server-amd64.iso
#ubuntu-24.04-live-server-amd64.iso: ISO 9660 CD-ROM filesystem data (DOS/MBR boot sector) 'Ubuntu-Server 24.04 LTS amd64' (bootable)
sha256sum ubuntu-24.04-live-server-amd64.iso
#8762f7e74e4d64d72fceb5f70682e6b069932deedb4949c6975d0f0fe0a91be3  ubuntu-24.04-live-server-amd64.iso


###############################################################
# The SHA256 file hashes match.
# File successfully decrypted.
# Only a public key and encrypted file were exchanged.
###############################################################

# Before: 8762f7e74e4d64d72fceb5f70682e6b069932deedb4949c6975d0f0fe0a91be3  ubuntu-24.04-live-server-amd64.iso
# After:  8762f7e74e4d64d72fceb5f70682e6b069932deedb4949c6975d0f0fe0a91be3  ubuntu-24.04-live-server-amd64.iso