<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing End-to-End Encryption

## openssl genpkey / pkeyutl

### Synopsis

```bash
openssl genpkey -algorithm <alg> [-out <file>]
openssl pkeyutl -derive -inkey <priv> -peerkey <pub> [-out <file>]
```

### Algorithms

| Algorithm | Use Case |
|---|---|
| X25519 | ECDH key agreement (recommended) |
| ED25519 | Digital signatures |
| RSA | Legacy encryption / signatures |

## age

### Synopsis

```bash
age-keygen [-o <identity>]
age -r <recipient> [-o <output>] <input>
age -d -i <identity> [-o <output>] <input>
```

## Agent Script

```bash
node agent.js keygen --algorithm X25519
node agent.js derive alice_priv.pem bob_pub.pem
node agent.js encrypt secret.txt -r age1pub... -o secret.age
node agent.js decrypt secret.age -i key.txt -o secret.txt
```
