age 暗号化：ポスト量子対応の受信者とパスキー

The age format

age is a small file-encryption format by Filippo Valsorda and Ben Cartwright-Cox, specified by C2SP. A file starts with the line age-encryption.org/v1 and a header of stanzas, one per recipient. Each stanza wraps the same random 16-byte file key for one recipient. A MAC over the header follows, keyed from the file key, so nobody can add or change recipients without being noticed. The payload is encrypted with ChaCha20-Poly1305 in 64 KiB chunks. Every chunk is authenticated on its own, and the last one is marked, so truncating, reordering or extending a file is detected. With ASCII armor the file becomes PEM-style text that can be pasted into an email or a chat.

Because the recipients are listed in the header, the page can show who a file is encrypted to, and how large its parts are, without any key. Choose "Inspect header" on the Decrypt tab.

Recipient types

• X25519 (age1…). The original: the stanza carries an ephemeral X25519 share. It is compact (a 32-byte public key), but a file recorded today could be decrypted by a future quantum computer.
• ML-KEM-768 + X25519 (age1pq1…). The post-quantum hybrid: the file key is wrapped with HPKE using the MLKEM768-X25519 KEM, so it stays confidential as long as either ML-KEM or X25519 holds. The cost is size: a 1,216-byte public key, which makes a recipient string about two thousand characters long, and about 1.5 KB more header per recipient and file. Identities start with AGE-SECRET-KEY-PQ-1.
• Tag recipients (age1tag1…, age1tagpq1…). For hardware keys such as a YubiKey or a TPM: files are encrypted here and decrypted on the device, never in a browser.
• Passphrases (scrypt). The file key is wrapped with a key derived from the passphrase by scrypt, a deliberately slow password hash. Its work factor is log₂ of the scrypt cost: age uses 18 by default and refuses more than 20 when decrypting. A passphrase stanza must be the only one in the file.

A file can mix recipient types, but it is then only as strong against a quantum computer as its weakest recipient; the page warns about such mixes. The size chart on the Encrypt tab compares the four key types.

Passkeys

A passkey can protect an age file through the WebAuthn PRF extension. The authenticator derives a secret from its credential and an input chosen per file; age turns that secret into the key that wraps the file key. Each file uses fresh inputs, so one fingerprint or PIN decrypts one file. The stanzas and the AGE-PLUGIN-FIDO2PRF-1… identity follow typage, the age authors' TypeScript implementation, so files interoperate with it and with age-plugin-fido2prf on the command line.

The PRF extension is recent. It needs a secure context (HTTPS), a browser that implements it, and an authenticator that supports it. Many platform authenticators and security keys do, but not all. The page asks the browser and says plainly when passkeys are unavailable. When a new passkey turns out not to support PRF, it says so instead of creating one that cannot decrypt. A passkey is bound to this site's domain. A file encrypted to it here decrypts here, or wherever the same relying party ID is used.

Test-kit examples

The examples come from the C2SP CCTV test kit for age: files that must decrypt (X25519, the post-quantum hybrid, armored, a passphrase) and files that must fail in a specific way (an identity that does not match, a forged header MAC). The page reports each outcome the way the kit names it, and checks that the decrypted payload's SHA-256 is the one the kit expects. The identities in these examples are the kit's published test keys, not anyone's real ones.

When to use which

For files that must stay confidential beyond the next decade, encrypt to age1pq1… recipients: that is the harvest-now-decrypt-later threat the post-quantum migration is about. age vs GPG compares age with OpenPGP for everyday use. How the hybrid KEM inside works is shown step by step in the ML-KEM lab and the HPKE playground.