Hybrid encryption.
Two key exchanges, one file. Hybrid post-quantum encryption runs ML-KEM-768 alongside X25519 and mixes both results into the file key, so an attacker has to break both to read anything. If either one holds, your file stays secret.
Hybrid encryption in the post-quantum sense means combining a post-quantum KEM with a classical one, here ML-KEM-768 with X25519, and deriving the file key from both shared secrets together.
What it is
The construction age uses is X-Wing, which encapsulates once with ML-KEM-768 and once with X25519, then feeds both shared secrets plus the transcript into a single key derivation. age names this recipient type mlkem768x25519. Recipients begin age1pq and are long, roughly 1,950 characters, because an ML-KEM-768 public key is far larger than a 32 byte curve point. The age CLI 1.3 and newer reads them; AgePony 3.0 introduced them in the app.
Why it matters
Hybrid is the conservative choice. ML-KEM is young by cryptographic standards, and lattice cryptanalysis is an active field, so betting a file entirely on it would be a new kind of risk. X25519 has two decades of scrutiny but falls to a quantum computer. Running both means a break in either primitive is survivable, and you only lose if both fail. There is one rule that follows from this and it is important: a post-quantum recipient cannot be mixed with a classical one on the same file. age encrypts the file key once per recipient, so any single recipient who can be broken exposes the whole file. Adding a classical recipient beside a post-quantum one would let the weakest recipient set the bar and quietly undo the protection. Encrypt to post-quantum recipients on one file and classical recipients on another.
The age CLI 1.3 and newer accepts an mlkem768x25519 recipient anywhere a classical one goes.
Related terms
Common questions.
Can I encrypt to a post-quantum recipient and a classical one at once?
No. A file encrypted to several recipients is only as strong as the weakest of them, so a classical recipient would set the bar for the whole file. AgePony keeps post-quantum and classical recipients on separate files.
What can open a file encrypted to an age1pq recipient?
AgePony 3.0 and newer, and the age CLI version 1.3 and newer, which reads the mlkem768x25519 recipient type. Older age builds do not recognise the stanza.
Get AgePony
Free file encryption for iOS and Android. No accounts, no tracking, no servers.