AgePony
download
Open Source · Apache-2.0

Read the code.

Encryption you can't inspect is a promise, not a guarantee. Both AgePony apps are public in full, not just the crypto cores.

The repositories

There are two, one per platform, both under the Apache License 2.0. Clone either, build it, audit it, or fork it.

The crypto cores

Each app is built over a self-contained cryptographic core with clean boundaries and no app dependencies. AgePonyCore is pure Swift, agepony-core is pure Kotlin, and both implement the same things:

  • age: X25519 + ChaCha20-Poly1305 STREAM, the v1 file format, scrypt passphrase stanzas.
  • ML-KEM-768: the FIPS 203 lattice KEM, combined with X25519 for post-quantum recipients.
  • SSH key parsing: ed25519 and RSA public keys as recipients, identity parsing for signing.
  • SSHSIG: signatures in the ssh-keygen -Y sign format, detached or sealed inside a signed bundle.
  • FIDO / CTAP2 + PIN: the security-key stack, including PIN/UV protocol-1 and the clientPin commands.
  • streaming tar archiver: the USTAR bundler behind multi-file archives and signed bundles.

Both cores are pinned to the same reference test vectors. That is what makes the implementations bit-compatible with the age CLI and OpenSSH, and with each other: a file encrypted on an iPhone opens on an Android phone, and a signature made on one verifies on the other.

Verify it yourself

# a file encrypted in AgePony, decrypted by the reference CLI age -d -i identity.txt bundle.tar.age | tar -tf - # a signature made in AgePony, verified by OpenSSH ssh-keygen -Y verify -f allowed_signers \ -I you@example.com -n agepony \ -s report.pdf.sig < report.pdf

License

Apache-2.0: use it, modify it, ship it, with attribution and the standard patent grant. The full text is in each repository's LICENSE file.

The sibling cores

AgePony's cousin PGPony publishes its OpenPGP cores too: PGPonyCore (Swift) and PGPonyCore-Kotlin, both Apache-2.0.