mirror of
https://github.com/FiloSottile/age.git
synced 2025-12-23 05:25:14 +00:00
442 lines
20 KiB
HTML
442 lines
20 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta http-equiv='content-type' content='text/html;charset=utf8'>
|
|
<meta name='generator' content='Ronn-NG/v0.9.1 (http://github.com/apjanke/ronn-ng/tree/0.9.1)'>
|
|
<title>age(1) - simple, modern, and secure file encryption</title>
|
|
<style type='text/css' media='all'>
|
|
/* style: man */
|
|
body#manpage {margin:0}
|
|
.mp {max-width:100ex;padding:0 9ex 1ex 4ex}
|
|
.mp p,.mp pre,.mp ul,.mp ol,.mp dl {margin:0 0 20px 0}
|
|
.mp h2 {margin:10px 0 0 0}
|
|
.mp > p,.mp > pre,.mp > ul,.mp > ol,.mp > dl {margin-left:8ex}
|
|
.mp h3 {margin:0 0 0 4ex}
|
|
.mp dt {margin:0;clear:left}
|
|
.mp dt.flush {float:left;width:8ex}
|
|
.mp dd {margin:0 0 0 9ex}
|
|
.mp h1,.mp h2,.mp h3,.mp h4 {clear:left}
|
|
.mp pre {margin-bottom:20px}
|
|
.mp pre+h2,.mp pre+h3 {margin-top:22px}
|
|
.mp h2+pre,.mp h3+pre {margin-top:5px}
|
|
.mp img {display:block;margin:auto}
|
|
.mp h1.man-title {display:none}
|
|
.mp,.mp code,.mp pre,.mp tt,.mp kbd,.mp samp,.mp h3,.mp h4 {font-family:monospace;font-size:14px;line-height:1.42857142857143}
|
|
.mp h2 {font-size:16px;line-height:1.25}
|
|
.mp h1 {font-size:20px;line-height:2}
|
|
.mp {text-align:justify;background:#fff}
|
|
.mp,.mp code,.mp pre,.mp pre code,.mp tt,.mp kbd,.mp samp {color:#131211}
|
|
.mp h1,.mp h2,.mp h3,.mp h4 {color:#030201}
|
|
.mp u {text-decoration:underline}
|
|
.mp code,.mp strong,.mp b {font-weight:bold;color:#131211}
|
|
.mp em,.mp var {font-style:italic;color:#232221;text-decoration:none}
|
|
.mp a,.mp a:link,.mp a:hover,.mp a code,.mp a pre,.mp a tt,.mp a kbd,.mp a samp {color:#0000ff}
|
|
.mp b.man-ref {font-weight:normal;color:#434241}
|
|
.mp pre {padding:0 4ex}
|
|
.mp pre code {font-weight:normal;color:#434241}
|
|
.mp h2+pre,h3+pre {padding-left:0}
|
|
ol.man-decor,ol.man-decor li {margin:3px 0 10px 0;padding:0;float:left;width:33%;list-style-type:none;text-transform:uppercase;color:#999;letter-spacing:1px}
|
|
ol.man-decor {width:100%}
|
|
ol.man-decor li.tl {text-align:left}
|
|
ol.man-decor li.tc {text-align:center;letter-spacing:4px}
|
|
ol.man-decor li.tr {text-align:right;float:right}
|
|
</style>
|
|
</head>
|
|
<!--
|
|
The following styles are deprecated and will be removed at some point:
|
|
div#man, div#man ol.man, div#man ol.head, div#man ol.man.
|
|
|
|
The .man-page, .man-decor, .man-head, .man-foot, .man-title, and
|
|
.man-navigation should be used instead.
|
|
-->
|
|
<body id='manpage'>
|
|
<div class='mp' id='man'>
|
|
|
|
<div class='man-navigation' style='display:none'>
|
|
<a href="#NAME">NAME</a>
|
|
<a href="#SYNOPSIS">SYNOPSIS</a>
|
|
<a href="#DESCRIPTION">DESCRIPTION</a>
|
|
<a href="#OPTIONS">OPTIONS</a>
|
|
<a href="#RECIPIENTS-AND-IDENTITIES">RECIPIENTS AND IDENTITIES</a>
|
|
<a href="#EXIT-STATUS">EXIT STATUS</a>
|
|
<a href="#BACKWARDS-COMPATIBILITY">BACKWARDS COMPATIBILITY</a>
|
|
<a href="#EXAMPLES">EXAMPLES</a>
|
|
<a href="#SEE-ALSO">SEE ALSO</a>
|
|
<a href="#AUTHORS">AUTHORS</a>
|
|
</div>
|
|
|
|
<ol class='man-decor man-head man head'>
|
|
<li class='tl'>age(1)</li>
|
|
<li class='tc'></li>
|
|
<li class='tr'>age(1)</li>
|
|
</ol>
|
|
|
|
|
|
|
|
<h2 id="NAME">NAME</h2>
|
|
<p class="man-name">
|
|
<code>age</code> - <span class="man-whatis">simple, modern, and secure file encryption</span>
|
|
</p>
|
|
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
|
|
|
<p><code>age</code> [<code>--encrypt</code>] (<code>-r</code> <var>RECIPIENT</var> | <code>-R</code> <var>PATH</var>)... [<code>--armor</code>] [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br>
|
|
<code>age</code> [<code>--encrypt</code>] <code>--passphrase</code> [<code>--armor</code>] [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br>
|
|
<code>age</code> <code>--decrypt</code> [<code>-i</code> <var>PATH</var> | <code>-j</code> <var>PLUGIN</var>]... [<code>-o</code> <var>OUTPUT</var>] [<var>INPUT</var>]<br></p>
|
|
|
|
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
|
|
|
<p><code>age</code> encrypts or decrypts <var>INPUT</var> to <var>OUTPUT</var>. The <var>INPUT</var> argument is
|
|
optional and defaults to standard input. Only a single <var>INPUT</var> file may be
|
|
specified. If <code>-o</code> is not specified, <var>OUTPUT</var> defaults to standard output.</p>
|
|
|
|
<p>If <code>-p</code>/<code>--passphrase</code> is specified, the file is encrypted with a passphrase
|
|
requested interactively. Otherwise, it's encrypted to one or more
|
|
<a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS</a> specified with <code>-r</code>/<code>--recipient</code> or
|
|
<code>-R</code>/<code>--recipients-file</code>. Every recipient can decrypt the file.</p>
|
|
|
|
<p>In <code>-d</code>/<code>--decrypt</code> mode, passphrase-encrypted files are detected automatically
|
|
and the passphrase is requested interactively. Otherwise, one or more
|
|
<a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> specified with <code>-i</code>/<code>--identity</code> are
|
|
used to decrypt the file.</p>
|
|
|
|
<p><code>age</code> encrypted files are binary and not malleable, with around 200 bytes of
|
|
overhead per recipient, plus 16 bytes every 64KiB of plaintext.</p>
|
|
|
|
<h2 id="OPTIONS">OPTIONS</h2>
|
|
|
|
<dl>
|
|
<dt>
|
|
<code>-o</code>, <code>--output</code>=<var>OUTPUT</var>
|
|
</dt>
|
|
<dd> Write encrypted or decrypted file to <var>OUTPUT</var> instead of standard output.
|
|
If <var>OUTPUT</var> already exists it will be overwritten.
|
|
|
|
<p>If encrypting without <code>--armor</code>, <code>age</code> will refuse to output binary to a
|
|
TTY. This can be forced by specifying <code>-</code> as <var>OUTPUT</var>.</p>
|
|
</dd>
|
|
<dt><code>--version</code></dt>
|
|
<dd> Print the version and exit.</dd>
|
|
</dl>
|
|
|
|
<h3 id="Encryption-options">Encryption options</h3>
|
|
|
|
<dl>
|
|
<dt>
|
|
<code>-e</code>, <code>--encrypt</code>
|
|
</dt>
|
|
<dd> Encrypt <var>INPUT</var> to <var>OUTPUT</var>. This is the default.</dd>
|
|
<dt>
|
|
<code>-r</code>, <code>--recipient</code>=<var>RECIPIENT</var>
|
|
</dt>
|
|
<dd> Encrypt to the explicitly specified <var>RECIPIENT</var>. See the
|
|
<a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS AND IDENTITIES</a> section for possible recipient formats.
|
|
|
|
<p>This option can be repeated and combined with other recipient flags,
|
|
and the file can be decrypted by all provided recipients independently.</p>
|
|
</dd>
|
|
<dt>
|
|
<code>-R</code>, <code>--recipients-file</code>=<var>PATH</var>
|
|
</dt>
|
|
<dd> Encrypt to the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS</a> listed in the
|
|
file at <var>PATH</var>, one per line. Empty lines and lines starting with <code>#</code>
|
|
are ignored as comments.
|
|
|
|
<p>If <var>PATH</var> is <code>-</code>, the recipients are read from standard input. In
|
|
this case, the <var>INPUT</var> argument must be specified.</p>
|
|
|
|
<p>This option can be repeated and combined with other recipient flags,
|
|
and the file can be decrypted by all provided recipients independently.</p>
|
|
</dd>
|
|
<dt>
|
|
<code>-p</code>, <code>--passphrase</code>
|
|
</dt>
|
|
<dd> Encrypt with a passphrase, requested interactively from the terminal.
|
|
<code>age</code> will offer to auto-generate a secure passphrase.
|
|
|
|
<p>This option can't be used with other recipient flags.</p>
|
|
</dd>
|
|
<dt>
|
|
<code>-a</code>, <code>--armor</code>
|
|
</dt>
|
|
<dd> Encrypt to an ASCII-only "armored" encoding.
|
|
|
|
<p><code>age</code> armor is a strict version of PEM with type <code>AGE ENCRYPTED FILE</code>,
|
|
canonical "strict" Base64, no headers, and no support for leading and
|
|
trailing extra data.</p>
|
|
|
|
<p>Decryption transparently detects and decodes ASCII armoring.</p>
|
|
</dd>
|
|
<dt>
|
|
<code>-i</code>, <code>--identity</code>=<var>PATH</var>
|
|
</dt>
|
|
<dd> Encrypt to the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">RECIPIENTS</a> corresponding to the
|
|
<a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> listed in the file at <var>PATH</var>. This
|
|
is equivalent to converting the file at <var>PATH</var> to a recipients file with
|
|
<code>age-keygen -y</code> and then passing that to <code>-R</code>/<code>--recipients-file</code>.
|
|
|
|
<p>For the format of <var>PATH</var>, see the definition of <code>-i</code>/<code>--identity</code> in the
|
|
<a href="#Decryption-options" title="Decryption options" data-bare-link="true">Decryption options</a> section.</p>
|
|
|
|
<p><code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-i</code>/<code>--identity</code>
|
|
in encryption mode to avoid confusion.</p>
|
|
</dd>
|
|
<dt>
|
|
<code>-j</code> <var>PLUGIN</var>
|
|
</dt>
|
|
<dd> Encrypt using the data-less <a href="#Plugins" title="Plugins" data-bare-link="true">plugin</a> <var>PLUGIN</var>.
|
|
|
|
<p>This is equivalent to using <code>-i</code>/<code>--identity</code> with a file that contains a
|
|
single plugin <code>IDENTITY</code> that encodes no plugin-specific data.</p>
|
|
|
|
<p><code>-e</code>/<code>--encrypt</code> must be explicitly specified when using <code>-j</code> in encryption
|
|
mode to avoid confusion.</p>
|
|
</dd>
|
|
</dl>
|
|
|
|
<h3 id="Decryption-options">Decryption options</h3>
|
|
|
|
<dl>
|
|
<dt>
|
|
<code>-d</code>, <code>--decrypt</code>
|
|
</dt>
|
|
<dd> Decrypt <var>INPUT</var> to <var>OUTPUT</var>.
|
|
|
|
<p>If <var>INPUT</var> is passphrase encrypted, it will be automatically detected
|
|
and the passphrase will be requested interactively. Otherwise, the
|
|
<a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> specified with <code>-i</code>/<code>--identity</code>
|
|
are used.</p>
|
|
|
|
<p>ASCII armoring is transparently detected and decoded.</p>
|
|
</dd>
|
|
<dt>
|
|
<code>-i</code>, <code>--identity</code>=<var>PATH</var>
|
|
</dt>
|
|
<dd> Decrypt using the <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> at <var>PATH</var>.
|
|
|
|
<p><var>PATH</var> may be one of the following:</p>
|
|
|
|
<p>a. A file listing <a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> one per line.
|
|
Empty lines and lines starting with "<code>#</code>" are ignored as comments.</p>
|
|
|
|
<p>b. A passphrase encrypted age file, containing
|
|
<a href="#RECIPIENTS-AND-IDENTITIES" title="RECIPIENTS AND IDENTITIES" data-bare-link="true">IDENTITIES</a> one per line like above.
|
|
The passphrase is requested interactively. Note that passphrase-protected
|
|
identity files are not necessary for most use cases, where access to the
|
|
encrypted identity file implies access to the whole system.</p>
|
|
|
|
<p>c. An SSH private key file, in PKCS#1, PKCS#8, or OpenSSH format.
|
|
If the private key is password-protected, the password is requested
|
|
interactively only if the SSH identity matches the file. See the
|
|
<a href="#SSH-keys" title="SSH keys" data-bare-link="true">SSH keys</a> section for more information, including supported key types.</p>
|
|
|
|
<p>d. "<code>-</code>", causing one of the options above to be read from standard input.
|
|
In this case, the <var>INPUT</var> argument must be specified.</p>
|
|
|
|
<p>This option can be repeated. Identities are tried in the order in which are
|
|
provided, and the first one matching one of the file's recipients is used.
|
|
Unused identities are ignored, but it is an error if the <var>INPUT</var> file is
|
|
passphrase-encrypted and <code>-i</code>/<code>--identity</code> is specified.</p>
|
|
</dd>
|
|
<dt>
|
|
<code>-j</code> <var>PLUGIN</var>
|
|
</dt>
|
|
<dd> Decrypt using the data-less <a href="#Plugins" title="Plugins" data-bare-link="true">plugin</a> <var>PLUGIN</var>.
|
|
|
|
<p>This is equivalent to using <code>-i</code>/<code>--identity</code> with a file that contains a
|
|
single plugin <code>IDENTITY</code> that encodes no plugin-specific data.</p>
|
|
</dd>
|
|
</dl>
|
|
|
|
<h2 id="RECIPIENTS-AND-IDENTITIES">RECIPIENTS AND IDENTITIES</h2>
|
|
|
|
<p><code>RECIPIENTS</code> are public values, like a public key, that a file can be encrypted
|
|
to. <code>IDENTITIES</code> are private values, like a private key, that allow decrypting
|
|
a file encrypted to the corresponding <code>RECIPIENT</code>.</p>
|
|
|
|
<h3 id="Native-X25519-keys">Native X25519 keys</h3>
|
|
|
|
<p>Native <code>age</code> key pairs are generated with <a class="man-ref" href="age-keygen.1.html">age-keygen<span class="s">(1)</span></a>, and provide small
|
|
encodings and strong encryption based on X25519. They are the recommended
|
|
recipient type for most applications.</p>
|
|
|
|
<p>A <code>RECIPIENT</code> encoding begins with <code>age1</code> and looks like the following:</p>
|
|
|
|
<pre><code>age1gde3ncmahlqd9gg50tanl99r960llztrhfapnmx853s4tjum03uqfssgdh
|
|
</code></pre>
|
|
|
|
<p>An <code>IDENTITY</code> encoding begins with <code>AGE-SECRET-KEY-1</code> and looks like the
|
|
following:</p>
|
|
|
|
<pre><code>AGE-SECRET-KEY-1KTYK6RVLN5TAPE7VF6FQQSKZ9HWWCDSKUGXXNUQDWZ7XXT5YK5LSF3UTKQ
|
|
</code></pre>
|
|
|
|
<p>An encrypted file can't be linked to the native recipient it's encrypted to
|
|
without access to the corresponding identity.</p>
|
|
|
|
<h3 id="SSH-keys">SSH keys</h3>
|
|
|
|
<p>As a convenience feature, <code>age</code> also supports encrypting to RSA or Ed25519
|
|
<span class="man-ref">ssh<span class="s">(1)</span></span> keys. RSA keys must be at least 2048 bits. This feature employs more
|
|
complex cryptography, and should only be used when a native key is not available
|
|
for the recipient. Note that SSH keys might not be protected long-term by the
|
|
recipient, since they are revokable when used only for authentication.</p>
|
|
|
|
<p>A <code>RECIPIENT</code> encoding is an SSH public key in <code>authorized_keys</code> format
|
|
(see the <code>AUTHORIZED_KEYS FILE FORMAT</code> section of <span class="man-ref">sshd<span class="s">(8)</span></span>), starting with
|
|
<code>ssh-rsa</code> or <code>ssh-ed25519</code>, like the following:</p>
|
|
|
|
<pre><code>ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDULTit0KUehbi[...]GU4BtElAbzh8=
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9pO5pz22JZEas[...]l1uZc31FGYMXa
|
|
</code></pre>
|
|
|
|
<p>The comment at the end of the line, if present, is ignored.</p>
|
|
|
|
<p>In recipient files passed to <code>-R</code>/<code>--recipients-file</code>, unsupported but valid
|
|
SSH public keys are ignored with a warning, to facilitate using
|
|
<code>authorized_keys</code> or GitHub <code>.keys</code> files. (See <a href="#EXAMPLES" title="EXAMPLES" data-bare-link="true">EXAMPLES</a>.)</p>
|
|
|
|
<p>An <code>IDENTITY</code> is an SSH private key <em>file</em> passed individually to
|
|
<code>-i</code>/<code>--identity</code>. Note that keys held on hardware tokens such as YubiKeys
|
|
or accessed via <span class="man-ref">ssh-agent<span class="s">(1)</span></span> are not supported.</p>
|
|
|
|
<p>An encrypted file <em>can</em> be linked to the SSH public key it was encrypted to.
|
|
This is so that <code>age</code> can identify the correct SSH private key before
|
|
requesting its password, if any.</p>
|
|
|
|
<h3 id="Plugins">Plugins</h3>
|
|
|
|
<p><code>age</code> can be extended through plugins. A plugin is only loaded if a corresponding
|
|
<code>RECIPIENT</code> or <code>IDENTITY</code> is specified. (Simply decrypting a file encrypted with
|
|
a plugin will not cause it to load, for security reasons among others.)</p>
|
|
|
|
<p>A <code>RECIPIENT</code> for a plugin named <code>example</code> starts with <code>age1example1</code>, while an
|
|
<code>IDENTITY</code> starts with <code>AGE-PLUGIN-EXAMPLE-1</code>. They both encode arbitrary
|
|
plugin-specific data, and are generated by the plugin.</p>
|
|
|
|
<p>When either is specified, <code>age</code> searches for <code>age-plugin-example</code> in the PATH
|
|
and executes it to perform the file header encryption or decryption. The plugin
|
|
may request input from the user through <code>age</code> to complete the operation.</p>
|
|
|
|
<p>Plugins can be freely mixed with other plugins or natively supported keys.</p>
|
|
|
|
<p>A plugin is not bound to only encrypt or decrypt files meant for or generated by
|
|
the plugin. For example, a plugin can be used to decrypt files encrypted to a
|
|
native X25519 <code>RECIPIENT</code> or even with a passphrase. Similarly, a plugin can
|
|
encrypt a file such that it can be decrypted without the use of any plugin.</p>
|
|
|
|
<p>Plugins for which the <code>IDENTITY</code>/<code>RECIPIENT</code> distinction doesn't make sense
|
|
(such as a symmetric encryption plugin) may generate only an <code>IDENTITY</code> and
|
|
instruct the user to perform encryption with the <code>-e</code>/<code>--encrypt</code> and
|
|
<code>-i</code>/<code>--identity</code> flags. Plugins for which the concept of separate identities
|
|
doesn't make sense (such as a password-encryption plugin) may instruct the user
|
|
to use the <code>-j</code> flag.</p>
|
|
|
|
<h2 id="EXIT-STATUS">EXIT STATUS</h2>
|
|
|
|
<p><code>age</code> will exit 0 if and only if encryption or decryption are successful for the
|
|
full length of the input.</p>
|
|
|
|
<p>If an error occurs during decryption, partial output might still be generated,
|
|
but only if it was possible to securely authenticate it. No unauthenticated
|
|
output is ever released.</p>
|
|
|
|
<h2 id="BACKWARDS-COMPATIBILITY">BACKWARDS COMPATIBILITY</h2>
|
|
|
|
<p>Files encrypted with a stable version (not alpha, beta, or release candidate) of
|
|
<code>age</code>, or with any v1.0.0 beta or release candidate, will decrypt with any later
|
|
version of the tool.</p>
|
|
|
|
<p>If decrypting older files poses a security risk, doing so might cause an error
|
|
by default. In this case, a flag will be provided to force the operation.</p>
|
|
|
|
<h2 id="EXAMPLES">EXAMPLES</h2>
|
|
|
|
<p>Generate a new identity, encrypt data, and decrypt:</p>
|
|
|
|
<pre><code>$ age-keygen -o key.txt
|
|
Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
|
|
|
|
$ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
|
|
|
|
$ age -d -o data.tar.gz -i key.txt data.tar.gz.age
|
|
</code></pre>
|
|
|
|
<p>Encrypt <code>example.jpg</code> to multiple recipients and output to <code>example.jpg.age</code>:</p>
|
|
|
|
<pre><code>$ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
|
|
-r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example.jpg
|
|
</code></pre>
|
|
|
|
<p>Encrypt to a list of recipients:</p>
|
|
|
|
<pre><code>$ cat > recipients.txt
|
|
# Alice
|
|
age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
|
|
# Bob
|
|
age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg
|
|
|
|
$ age -R recipients.txt example.jpg > example.jpg.age
|
|
</code></pre>
|
|
|
|
<p>Encrypt and decrypt a file using a passphrase:</p>
|
|
|
|
<pre><code>$ age -p secrets.txt > secrets.txt.age
|
|
Enter passphrase (leave empty to autogenerate a secure one):
|
|
Using the autogenerated passphrase "release-response-step-brand-wrap-ankle-pair-unusual-sword-train".
|
|
|
|
$ age -d secrets.txt.age > secrets.txt
|
|
Enter passphrase:
|
|
</code></pre>
|
|
|
|
<p>Encrypt and decrypt with a passphrase-protected identity file:</p>
|
|
|
|
<pre><code>$ age-keygen | age -p > key.age
|
|
Public key: age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5
|
|
Enter passphrase (leave empty to autogenerate a secure one):
|
|
Using the autogenerated passphrase "hip-roast-boring-snake-mention-east-wasp-honey-input-actress".
|
|
|
|
$ age -r age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5 secrets.txt > secrets.txt.age
|
|
|
|
$ age -d -i key.age secrets.txt.age > secrets.txt
|
|
Enter passphrase for identity file "key.age":
|
|
</code></pre>
|
|
|
|
<p>Encrypt and decrypt with an SSH public key:</p>
|
|
|
|
<pre><code>$ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
|
|
|
|
$ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
|
|
</code></pre>
|
|
|
|
<p>Encrypt and decrypt with age-plugin-yubikey:</p>
|
|
|
|
<pre><code>$ age-plugin-yubikey # run interactive setup, generate identity file and obtain recipient
|
|
|
|
$ age -r age1yubikey1qwt50d05nh5vutpdzmlg5wn80xq5negm4uj9ghv0snvdd3yysf5yw3rhl3t secrets.txt > secrets.txt.age
|
|
|
|
$ age -d -i age-yubikey-identity-388178f3.txt secrets.txt.age
|
|
</code></pre>
|
|
|
|
<p>Encrypt to the SSH keys of a GitHub user:</p>
|
|
|
|
<pre><code>$ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
|
|
</code></pre>
|
|
|
|
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
|
|
|
<p><a class="man-ref" href="age-keygen.1.html">age-keygen<span class="s">(1)</span></a></p>
|
|
|
|
<h2 id="AUTHORS">AUTHORS</h2>
|
|
|
|
<p>Filippo Valsorda <a href="mailto:age@filippo.io" data-bare-link="true">age@filippo.io</a></p>
|
|
|
|
<ol class='man-decor man-foot man foot'>
|
|
<li class='tl'></li>
|
|
<li class='tc'>June 2024</li>
|
|
<li class='tr'>age(1)</li>
|
|
</ol>
|
|
|
|
</div>
|
|
</body>
|
|
</html>
|