Generate statum-genkeys keys through Locksmith

The three keygen blocks (signing, encryption-signing, sealing) become KeyPair.generate() calls; output uses to_secret_key_base64() and public_key.to_base64(). Field names, JSON shape, 0600 mode, --out semantics and SA-12 secret handling are unchanged.

tools/statum-genkeys/statum-genkeys.vala

@@ -1,4 +1,4 @@
-using Sodium;
+using Locksmith;
 
 namespace Statum.Tools {
 
@@ -53,31 +53,25 @@ namespace Statum.Tools {
             }
 
             // Signing (Ed25519) key pair.
-            var sign_sk = new uint8[Sodium.Asymmetric.Signing.SECRET_KEY_BYTES];
-            var sign_pk = new uint8[Sodium.Asymmetric.Signing.PUBLIC_KEY_BYTES];
-            Sodium.Asymmetric.Signing.generate_keypair(sign_pk, sign_sk);
+            var sign = Signing.KeyPair.generate();
 
             // Encryption signing (Ed25519) key pair.
-            var esign_sk = new uint8[Sodium.Asymmetric.Signing.SECRET_KEY_BYTES];
-            var esign_pk = new uint8[Sodium.Asymmetric.Signing.PUBLIC_KEY_BYTES];
-            Sodium.Asymmetric.Signing.generate_keypair(esign_pk, esign_sk);
+            var esign = Signing.KeyPair.generate();
 
             // Encryption sealing (X25519) key pair.
-            var seal_sk = new uint8[Sodium.Asymmetric.Sealing.SECRET_KEY_BYTES];
-            var seal_pk = new uint8[Sodium.Asymmetric.Sealing.PUBLIC_KEY_BYTES];
-            Sodium.Asymmetric.Sealing.generate_keypair(seal_pk, seal_sk);
+            var seal = Sealing.KeyPair.generate();
 
             if (out_path != null) {
                 // Full config (secrets included) goes to the file only, mode 0600.
                 var full = new StringBuilder();
                 full.append("{\n");
                 full.append("  \"statum\": {\n");
-                full.append_printf("    \"signing_secret_key\": \"%s\",\n", Base64.encode(sign_sk));
-                full.append_printf("    \"signing_public_key\": \"%s\",\n", Base64.encode(sign_pk));
-                full.append_printf("    \"encryption_signing_secret_key\": \"%s\",\n", Base64.encode(esign_sk));
-                full.append_printf("    \"encryption_signing_public_key\": \"%s\",\n", Base64.encode(esign_pk));
-                full.append_printf("    \"encryption_sealing_secret_key\": \"%s\",\n", Base64.encode(seal_sk));
-                full.append_printf("    \"encryption_sealing_public_key\": \"%s\"\n", Base64.encode(seal_pk));
+                full.append_printf("    \"signing_secret_key\": \"%s\",\n", sign.to_secret_key_base64());
+                full.append_printf("    \"signing_public_key\": \"%s\",\n", sign.public_key.to_base64());
+                full.append_printf("    \"encryption_signing_secret_key\": \"%s\",\n", esign.to_secret_key_base64());
+                full.append_printf("    \"encryption_signing_public_key\": \"%s\",\n", esign.public_key.to_base64());
+                full.append_printf("    \"encryption_sealing_secret_key\": \"%s\",\n", seal.to_secret_key_base64());
+                full.append_printf("    \"encryption_sealing_public_key\": \"%s\"\n", seal.public_key.to_base64());
                 full.append("  }\n");
                 full.append("}\n");
 
@@ -87,7 +81,7 @@ namespace Statum.Tools {
 
                 stdout.printf("Wrote full key material to %s (mode 0600).\n", (!)out_path);
                 stdout.printf("The secret halves are in %s only — they are never printed to stdout.\n", (!)out_path);
-                print_public_halves(sign_pk, esign_pk, seal_pk);
+                print_public_halves(sign.public_key.to_base64(), esign.public_key.to_base64(), seal.public_key.to_base64());
                 return 0;
             }
 
@@ -96,9 +90,9 @@ namespace Statum.Tools {
             // --out (see SA-12).
             stdout.printf("{\n");
             stdout.printf("  \"statum\": {\n");
-            stdout.printf("    \"signing_public_key\": \"%s\",\n", Base64.encode(sign_pk));
-            stdout.printf("    \"encryption_signing_public_key\": \"%s\",\n", Base64.encode(esign_pk));
-            stdout.printf("    \"encryption_sealing_public_key\": \"%s\"\n", Base64.encode(seal_pk));
+            stdout.printf("    \"signing_public_key\": \"%s\",\n", sign.public_key.to_base64());
+            stdout.printf("    \"encryption_signing_public_key\": \"%s\",\n", esign.public_key.to_base64());
+            stdout.printf("    \"encryption_sealing_public_key\": \"%s\"\n", seal.public_key.to_base64());
             stdout.printf("  }\n");
             stdout.printf("}\n");
             stdout.printf("# Secret key halves are not printed. Use:\n");
@@ -107,10 +101,10 @@ namespace Statum.Tools {
             return 0;
         }
 
-        private static void print_public_halves(uint8[] sign_pk, uint8[] esign_pk, uint8[] seal_pk) {
-            stdout.printf("signing_public_key:                 %s\n", Base64.encode(sign_pk));
-            stdout.printf("encryption_signing_public_key:     %s\n", Base64.encode(esign_pk));
-            stdout.printf("encryption_sealing_public_key:     %s\n", Base64.encode(seal_pk));
+        private static void print_public_halves(string sign_pk, string esign_pk, string seal_pk) {
+            stdout.printf("signing_public_key:                 %s\n", sign_pk);
+            stdout.printf("encryption_signing_public_key:     %s\n", esign_pk);
+            stdout.printf("encryption_sealing_public_key:     %s\n", seal_pk);
         }
 
         /**