Module wrap 

The key ring, wrapped with age to every member’s USER encryption key (age1…, or age1pq1… in a quantum-safe repository), and unwrapped with that user key (crate::userkey).

A repository never names an SSH key or a security key. Those are unlock METHODS of a user’s encryption key: the SSH key file opens the user key in the CLI (age’s SSH recipients, below, under feature wrap), a security key opens it in the browser and the CLI, and the user key opens every ring the user is a member of. Adding a member is one more stanza, to their public user key: they need not be present.

age does every wrap: an age1… key is age’s X25519 recipient, an age1pq1… key is age’s hybrid ML-KEM-768 + X25519 recipient (crate::pq). One age file holds one stanza per member.

ssh-agent cannot unwrap. The agent protocol only signs; decryption needs the private scalar, so the CLI reads the key FILE and asks for its passphrase if it has one.

Re-exports

pub use crate::members::Level;

pub use age;

Structs

NoPassphrase

A passphrase source that never answers: for key files without one.

Enums

IdentityError

Why a key file could not be used as an identity.

UnwrapError

Why the unwrap failed.

WrapError

Why the wrap failed.

Constants

SSH_IS_NOT_PQ

What a member is told when an SSH key is offered to a quantum-safe ring.

Traits

Passphrase

A passphrase source for an encrypted SSH key file.

Functions

pq_identity

A post-quantum identity file (gunnar crypt keygen, or age-keygen -pq) as an age identity.

recipient

The age recipient of one member line: a user’s encryption key.

ssh_identity

An SSH private key file as an age identity. An encrypted key asks passphrase when it is first needed.

ssh_identity_unlocked

An SSH private key file as an age identity, decrypted NOW: an encrypted key asks passphrase once, here, rather than later in the middle of an unwrap: a passphrase is typed once, at start.

unwrap

Unwrap a key file with the given identities. The payload must be a key ring; anything else is refused and dropped (zeroed).

unwrap_checked

unwrap, after the ring’s stanzas are checked against the members file (policy::check_ring): one stanza per listed key, the SSH ones by their tags, no type the repository’s level does not allow. A ring with a stanza for someone the members file does not name is refused before anything is unwrapped.

wrap

Wrap ring to every key in members, with the scheme of its level; returns the armored age file (the content of .gunnar-crypt/keys).