age-encryption.org demo

age demo.md

Download & install

$ wget https://github.com/FiloSottile/age/releases/download/v1.0.0-beta2/age-v1.0.0-beta2-linux-amd64.tar.gz
$ tar -xzvf age-v1.0.0-beta2-linux-amd64.tar.gz
$ sudo cp age/* /usr/local/bin/

Generate a keypair

$ age-keygen -o ~/.age/(date +%s)-(hostname).key

Public key: age1cpl688jrevp2pfha9p4kmscelrjpgt9y7428kcdf6uue9dlx5uasvyjaxt

$ cat .age/1578325511-gator5.key 
# created: 2020-01-06T10:45:11-05:00
# public key: age1cpl688jrevp2pfha9p4kmscelrjpgt9y7428kcdf6uue9dlx5uasvyjaxt
AGE-SECRET-KEY-1T6LDP640JDZ39G3KZP23KGSS92RXRKFGEV4SSCUHX3TW9MT97T7SJNKZU7

Encrypt a file to the recipient's public key

$ age -r age1cpl688jrevp2pfha9p4kmscelrjpgt9y7428kcdf6uue9dlx5uasvyjaxt -o /tmp/encrypted_junk /tmp/randomjunk.txt

The resulting binary file has a age-encryption.org/v1 header

$ hexdump -C /tmp/encrypted_junk |head
00000000  61 67 65 2d 65 6e 63 72  79 70 74 69 6f 6e 2e 6f  |age-encryption.o|
00000010  72 67 2f 76 31 0a 2d 3e  20 58 32 35 35 31 39 20  |rg/v1.-> X25519 |
00000020  37 6d 49 65 31 4c 64 34  4f 68 6e 35 47 69 70 54  |7mIe1Ld4Ohn5GipT|
00000030  64 37 4b 65 31 42 70 6d  6d 4f 7a 63 4c 48 36 55  |d7Ke1BpmmOzcLH6U|
00000040  4d 53 32 37 50 45 69 4c  63 55 63 0a 45 4f 4e 2b  |MS27PEiLcUc.EON+|
00000050  59 6a 4f 35 6a 56 33 38  57 6e 63 41 6e 61 74 39  |YjO5jV38WncAnat9|
00000060  54 76 32 54 32 53 49 35  57 6a 54 31 4c 30 33 6c  |Tv2T2SI5WjT1L03l|
00000070  2f 72 44 46 32 30 67 0a  2d 2d 2d 20 48 6e 67 33  |/rDF20g.--- Hng3|
00000080  6b 76 37 70 72 54 31 4c  4b 43 63 75 2f 4e 48 4c  |kv7prT1LKCcu/NHL|
00000090  37 6e 47 76 35 43 4c 45  4b 4b 2b 30 38 38 4b 36  |7nGv5CLEKK+088K6|

You can also use SSH keys

 $ cat .ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQaFfG8D5Mo28I/oizTdWeyg6vDoJLkzRajvuddFKLf julien@gator5

$ age -r "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQaFfG8D5Mo28I/oizTdWeyg6vDoJLkzRajvuddFKLf" /tmp/randomjunk.small.txt > /tmp/encrypted_junk_small

$ age -i .ssh/id_ed25519 -d /tmp/encrypted_junk_small > /tmp/decrypted_junk
Enter passphrase for ".ssh/id_ed25519": ******

$ sha256sum /tmp/randomjunk.small.txt /tmp/decrypted_junk 
e928deab9ea448c5d24b6f160e47f807af49135fd5d46c4aec77cc11baa5d8a1  /tmp/randomjunk.small.txt
e928deab9ea448c5d24b6f160e47f807af49135fd5d46c4aec77cc11baa5d8a1  /tmp/decrypted_junk

The file format knows it uses an ssh key:

$ hexdump -C /tmp/encrypted_junk_small  |head
00000000  61 67 65 2d 65 6e 63 72  79 70 74 69 6f 6e 2e 6f  |age-encryption.o|
00000010  72 67 2f 76 31 0a 2d 3e  20 73 73 68 2d 65 64 32  |rg/v1.-> ssh-ed2|
00000020  35 35 31 39 20 4e 2f 72  33 64 41 20 32 76 57 65  |5519 N/r3dA 2vWe|