solo2/examples/AGE.md

File encryption with a SoloKey + age

Works on: Secure + Hacker. Uses FIDO2 hmac-secret.

age is a simple modern file-encryption tool. With age-plugin-fido2-hmac the decryption key is derived on the Solo (via hmac-secret), so files can only be decrypted with a touch of the key.

Install

brew install age                              # or your package manager
# install age-plugin-fido2-hmac from its releases / cargo; must be on PATH as `age-plugin-fido2-hmac`

Create an identity bound to the Solo

age-plugin-fido2-hmac -g                      # touch the Solo

This prints a recipient (age1fido2-hmac1…, share/encrypt to it) and an identity (AGE-PLUGIN-FIDO2-HMAC-…, keep it; it's a handle, the secret stays on the key). Save the identity to key.txt.

Encrypt / decrypt

age -r age1fido2-hmac1…  -o secret.age  secret.txt      # encrypt to the recipient
age -d -i key.txt        -o secret.txt  secret.age      # decrypt — touch the Solo

Exact flags vary slightly by plugin version (some versions use -j fido2-hmac or a symmetric mode); check age-plugin-fido2-hmac --help. The plugin uses the credential's hmac-secret (FIDO.md) to derive the file key.

Where this is used

• Encrypted backups: wrap a borg/restic repo key with age.
• Repo secrets: sops with an age recipient.
• Passwords: passage is pass built on age — pair it with this for a touch-to-unlock password store.