Age is a simple, modern and secure file encryption tool, format, and Go library

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just use it and expect you to have it" kind of standard.

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions.

Here are some previous discussions

132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504

126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141

113 points on June 11, 2022 | 33 comments | https://news.ycombinator.com/item?id=31705670

494 points on Sept 6, 2021 | 88 comments | https://news.ycombinator.com/item?id=28435613

466 points on Dec 27, 2019 | 199 comments | https://news.ycombinator.com/item?id=21895671

and here some related resources

- a list of age ecosystem projects https://github.com/FiloSottile/awesome-age

- the format specification https://c2sp.org/age

- the Go library docs https://pkg.go.dev/filippo.io/age

- the CLI man page https://filippo.io/age/age.1

- the large reusable test suite (which I should write about!) https://c2sp.org/CCTV/age

- an interoperable Rust implementation by @str4d https://github.com/str4d/rage

- an official TypeScript implementation https://github.com/FiloSottile/typage (based on libsodium.js in the latest version, and on pure-js Noble libraries on main)

- a YubiKey plugin by @str4d https://github.com/str4d/age-plugin-yubikey

- the plugin protocol specification https://c2sp.org/age-plugin

- a Windows GUI by @spieglt https://github.com/spieglt/winage

- a discussion of the authentication properties of age https://words.filippo.io/dispatches/age-authentication/

- a discussion of the plugin architecture https://words.filippo.io/dispatches/age-plugins/

- a discussion of a potential post-quantum plugin https://words.filippo.io/dispatches/post-quantum-age/

- a password-store fork that uses age instead of gpg https://github.com/FiloSottile/passage (see also: how I use it with a YubiKey https://words.filippo.io/dispatches/passage/)

Rust version: https://github.com/str4d/rage

Age (and its rust implementation Rage) combined with agenix[0] and age.el[1] has made my self-hosted deployment and management so, so easy without compromising security. That, when combined with general NixOS conveniences is why I'm able to self-host at all. If not for these, just the anxiety of having to setup new server in case of whatever loss and the associated time/opportunity loss kept me from dong the same for years.

Anyway, just want to say that Age is great!

P.S. The author also did an analysis of Restic the backup tool [2] which also prompted me to setup nice backup solution for my machines. Pretty cool.

[0]: https://github.com/ryantm/agenix

[1]: https://github.com/anticomputer/age.el

[2]: https://words.filippo.io/restic-cryptography/

I know there are specialized backup tools like restic or borg, but I like to keep things simple.

Is using age like this to encrypt my files before uploading them to untrusted cloud storage not ok?

tar > age > cloud

Some comments mention signing with minisign. Should I be doing that like this:

tar > age > minisign > cloud

When will there be a post quantum version, or a plugin by the same author?

Recommended in here I believe:

https://www.latacora.com/blog/2020/03/12/the-soc-starting/

Age is good at what it does, but note that afaik you probably should almost always pair it with something like signify[1], because age doesn't have integrity/authenticity verification (by design).

[1] https://man.openbsd.org/signify.1

Age is a much better experience than PGP/GPG, even though it only has a subset of GPG's features.

The option and argument handling is intuitive; it makes sense instantly. It gives a more grounded understanding of what's happening with the encryption process, especially because of the short-form recipient format.

Also, setting it up with a Yubikey and Passage (a GNU pass alternative for Age) was a breeze.

There is also an official typescript implementation [1] and sops supports it natively [2].

[1] https://github.com/FiloSottile/typage

[2] https://github.com/getsops/sops?tab=readme-ov-file#encryptin...

> The author pronounces it [aɡe̞] with a hard g, like GIF

Lol, or 'git' according to one of my more sensitive colleagues.

https://www.kryptor.co.uk/ is much more secure than age.

From their FAQ [0]:

>Kryptor uses strong, fast, and modern cryptographic algorithms, offering post-quantum security. It also addresses security limitations of tools like age and Minisign.

>Unlike most tools, Kryptor limits metadata by using an indistinguishable from random encrypted file format. Encrypted files have no identifiable headers and are randomly padded. File names can also be encrypted.

And from their Secure section [1]:

>Private key encryption for protection at rest, unlike age.

[0]: https://www.kryptor.co.uk/faq#why-should-i-use-kryptor-over-...

[1]: https://www.kryptor.co.uk/#secure

For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense?

Even then openssl or sq can solve the problem in the same number of commands but with sntabdards.

Most people are best off going with a modern implementation of the PGP standard, ideally via a smart card to protect you from key exfil via malware.

Tools like Keyfork, Sequoia, and/or openpgp-card-tool are almost certainly what you want for most personal signing, encryption, and authentication use cases.

You get broad compatibility with many many different tools.

The description claims it's "secure", but nothing pops up in the README when I Ctrl+F `audit`.

So maybe take the "secure" claims with a grain of salt.