agevault

agevault is a directory encryption tool using age file encryption.

It locks/unlocks a vault (directory) with a passphrase-protected identity file.

Like age, it features no config options, allowing for a straightforward secure flow.

This project has been tested, but has not undergone a formal security audit, and none is planned.

The codebase is intentionally kept simple and readable, so you're encouraged to review it yourself before relying on it for anything sensitive.

Use at your own risk (see LICENSE).

Always install the latest release to make sure you have the latest security improvements and fixes. If the update has the same major version (e.g. v1.x.x), then it's guaranteed to be backwards compatible.

Get them from the latest release.

$ nix run github:ndavd/agevault

$ go install github.com/ndavd/agevault@latest

$ docker build -t agevault .
$ docker run --rm -it -u ${UID}:${GID} -v .:/tmp agevault

lock/unlock directory with passphrase-protected identity file
usage: agevault [directory-name] lock|unlock|keygen

Securing my-vault/:

1. Generate identity file

$ agevault my-vault keygen
create identity passphrase: 
confirm identity passphrase: 
.age14tpkpl6vexufah8eq5dgrd5zy4xqs4slynh26j5n7gvxs87xhguqwu9zqc.my-vault.key.age CREATED (do not change the filename)

2. Lock vault

$ agevault my-vault lock
my-vault LOCKED with age14tpkpl6vexufah8eq5dgrd5zy4xqs4slynh26j5n7gvxs87xhguqwu9zqc

3. Unlock vault

$ agevault my-vault unlock
enter passphrase for identity file ".age14tpkpl6vexufah8eq5dgrd5zy4xqs4slynh26j5n7gvxs87xhguqwu9zqc.my-vault.key.age": 
my-vault UNLOCKED

4. That's it. Do your changes, lock it again, etc.

agevault relies entirely on age for the cryptography involved, inheriting its security. It provides the minimal infrastructure required for age to work as a directory encryption tool.

agevault uses a passphrase encrypted identity for a few key reasons:

• Extra security factor: Having the encrypted identity file or the passphrase by itself is useless.
• Easier to lock: If only symmetric encryption was used, the user would need the passphrase to lock as well; this way, the vault can be locked without entering the passphrase.
• Ability to support multiple keys in the future (planned features): This makes it possible to support multiple passphrases, each corresponding to its own key, so multiple people could own the vault: any one of them can lock it, and any one of them can unlock it with their own passphrase.

• Post-quantum keys
• Multi-user vault support