Filippo Valsorda, a cryptographer responsible for the security of the Go programming language at Google, has released the first stable version of a new data encryption utility — Age (Actually Good Encryption). The utility provides a simple command-line interface for encrypting files using both symmetric (password-based) and asymmetric (public key-based) cryptographic algorithms. The project code is written in Go and is distributed under the BSD license. Builds are available for Linux, FreeBSD, macOS, and Windows.
The basic functions have been extracted into a library that can be used to integrate the functionality provided by the utility into your programs. Additionally, within the rage project, an alternative implementation of a similar utility and library is being developed in Rust. For encryption, proven algorithms HKDF (HMAC-based Extract-and-Expand Key Derivation Function), SHA-256, HMAC (Hash-based Message Authentication Code), X25519, Scrypt, and ChaCha20-Poly1305 AEAD are used.
Из особенностей Age выделяется: возможность использования компактных 512-битных открытых ключей, легко переносимых через буфер обмена; простой и не перегруженный опциями интерфейс командной строки; отсутствие файлов конфигурации; возможность использования в скриптах и в комбинации с другими утилитами через выстраивание цепочки вызовов в UNIX-стиле. Поддерживается как генерация собственных компактных ключей, так и использование существующих ключей от SSH («ssh-ed25519», «ssh-rsa»), включая поддержку файлов Github.keys. $ age-keygen -o key.txt Public key: age1ql3z7hjy58pw3hyww5ayyfg7zqgvc7w3j2elw2zmrj2kg5sfn9bqmcac8p $ tar cvz ~/data | age -r age1ql3z7hjy58pw3hyww5ayyfg7zqgvc7w3j2elw2zmrj2kg5sfn9bqmcac8p > data.tar.gz.age $ age —decrypt -i key.txt data.tar.gz.age > data.tar.gz $ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age $ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
There is a file encryption mode for multiple recipients, where the file is simultaneously encrypted using several public keys, allowing each recipient on the list to decrypt it. Tools for symmetric file encryption based on a password and for protecting files with private keys by encrypting them using a password are also provided. A useful feature is that if an empty password is entered during encryption, the utility will automatically generate and suggest a strong password. $ age -p secrets.txt > secrets.txt.age Enter passphrase (leave empty to autogenerate a secure one): Using the autogenerated passphrase «release-response-step-brand-wrap-ankle-pair-unusual-sword-train». $ age -d secrets.txt.age > secrets.txt Enter passphrase: $ age-keygen | age -p > key.age Public key: age1yhm4gftwfmrpz87tdslm530wrx6m79y9f2hdzt0lndjnehwj0bkqrjpyx5 Enter passphrase (leave empty to autogenerate a secure one): Using the autogenerated passphrase «hip-roast-boring-snake-mention-east-wasp-honey-input-actress».
Future plans include creating a backend for storing passwords and a szerver shared keys (PAKE), support for YubiKey keys, the ability to generate memorable keys in the form of word sets, and the creation of the age-mount utility for mounting encrypted files or archives in the filesystem.
Forrás: opennet.ru
