Filippo Valsorda, a cryptographer responsible for the security of the Go programming language at Google, has published the first stable release of a new data encryption utility — Age (Actually Good Encryption). The utility provides a simple command-line interface for encrypting files using symmetric (password-based) and asymmetric (public key-based) cryptographic algorithms. The project's code is written in Go and is distributed under the BSD license. Builds are available for Linux, FreeBSD, macOS, and Windows.
The basic functions are included in a library that can be used to integrate the functionality provided by the utility into your own programs. Separately, within the project rage, an alternative implementation of a similar utility and library is being developed in Rust. Encryption uses proven algorithms HKDF (HMAC-based Extract-and-Expand Key Derivation Function), SHA-256, HMAC (Hash-based Message Authentication Code), X25519, Scrypt, and ChaCha20-Poly1305 AEAD.
Из особенностей Age выделяется: возможность использования компактных 512-битных открытых ключей, легко переносимых через буфер обмена; простой и не перегруженный опциями интерфейс командной строки; отсутствие файлов конфигурации; возможность использования в скриптах и в комбинации с другими утилитами через выстраивание цепочки вызовов в UNIX-стиле. Поддерживается как генерация собственных компактных ключей, так и использование существующих ключей от SSH («ssh-ed25519», «ssh-rsa»), включая поддержку файлов Github.keys. $ age-keygen -o key.txt Public key: age1ql3z7hjy58pw3hyww5ayyfg7zqgvc7w3j2elw2zmrj2kg5sfn9bqmcac8p $ tar cvz ~/data | age -r age1ql3z7hjy58pw3hyww5ayyfg7zqgvc7w3j2elw2zmrj2kg5sfn9bqmcac8p > data.tar.gz.age $ age —decrypt -i key.txt data.tar.gz.age > data.tar.gz $ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age $ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
There is a file encryption mode for multiple recipients, where a file is encrypted simultaneously with multiple public keys, allowing each recipient on the list to decrypt it. Symmetric encryption of files based on passwords and protection of files with private keys through their encryption using a password is also provided. A useful feature is that if an empty password is entered during encryption, the utility will automatically generate and suggest a secure password. $ age -p secrets.txt > secrets.txt.age Enter passphrase (leave empty to autogenerate a secure one): Using the autogenerated passphrase «release-response-step-brand-wrap-ankle-pair-unusual-sword-train». $ age -d secrets.txt.age > secrets.txt Enter passphrase: $ age-keygen | age -p > key.age Public key: age1yhm4gftwfmrpz87tdslm530wrx6m79y9f2hdzt0lndjnehwj0bkqrjpyx5 Enter passphrase (leave empty to autogenerate a secure one): Using the autogenerated passphrase «hip-roast-boring-snake-mention-east-wasp-honey-input-actress».
Future plans include the creation of a backend for password storage and server shared keys (PAKE), support for YubiKey keys, the ability to generate memorable keys in the form of a set of words, and the creation of a utility age-mount for mounting encrypted files or archives in the filesystem.
Source: opennet.ru
