age-plugin-hpke is a plugin for age. It provides an age Identity and Recipient consuming Hybrid Public Key Encrypted (HPKE) files.
HPKE is defined in RFC 9180, and age-plugin are defined by C2SP.
| Environment | CLI Command |
|:-------------------|:--------------------------|
| Cargo (Rust 1.67+) | cargo install --git https://github.com/thibmeu/age-plugin-hpke |
Read age installation instructions to install age.
You can use the --help option to get more details about the command and its options.
bash
age-plugin-hpke [OPTIONS]
Create an identity using Kyber768.
shell
age-plugin-hpke --generate --kem x25519-kyber768-draft00 --aead cha-cha20-poly1305 --associated-data "user@example.com" > my_id.key
For convenience, you can also create an associated recipient
shell
cat my_id.key | grep 'recipient' | sed 's/.*\(age1.*\)/\1/' > my_id.key.pub
The recipient and identity size are going to vary based on the KEM. With Post-quantum, keys are large.
Encrypt Hello age-plugin-hpke! string with your new key.
shell
echo 'Hello age-plugin-hpke!' | age -a -R my_id.key.pub > data.age
age --decrypt -i my_id.key data.age
Hello age-plugin-hpke!
This software has not been audited. Please use at your sole discretion. With this in mind, age-plugin-hpke security relies on the following:
hpke <ASSOCIATED_DATA> <KEM> <AEAD>
All data within the stanza are base64 encoded with no pad.
age1hpke1<KEM_ALG><AEAD_ALG><KDF_ALG><PUBLIC_KEY><ASSOCIATED_DATA>
AGE-PLUGIN-HPKE-<KEM_ALG><AEAD_ALG><KDF_ALG><PRIVATE_KEY><ASSOCIATED_DATA>
Why not? At the time of writting, age is available on multiple platform, has a file format allowing for agility, and a decent tooling to integrate with.
IETF format with HPKE in COSE might offer an alternative path down the line.
The underlying primitive used in the cli are exposed via a library. This includes the age stanza, recipient, and identity, as well as tools to generate an identity from scratch.
shell
cargo add age-plugin-hpke
This project is under the MIT license.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you shall be MIT licensed as above, without any additional terms or conditions.