Statum/tools/statum-genkeys/statum-genkeys.vala

using Sodium;

namespace Statum.Tools {

    /**
     * `statum-genkeys` — generates the static key pairs for signing and
     * encryption and prints a ready-to-paste `statum` section for
     * `web-config.json`.
     *
     * With these keys configured, signed frames and encrypted private blobs
     * survive a server restart (the same keys verify/decrypt across restarts).
     */
    public class Genkeys : Object {

        public static int main(string[] args) {
            // Signing (Ed25519) key pair.
            var sign_sk = new uint8[Sodium.Asymmetric.Signing.SECRET_KEY_BYTES];
            var sign_pk = new uint8[Sodium.Asymmetric.Signing.PUBLIC_KEY_BYTES];
            Sodium.Asymmetric.Signing.generate_keypair(sign_pk, sign_sk);

            // Encryption signing (Ed25519) key pair.
            var esign_sk = new uint8[Sodium.Asymmetric.Signing.SECRET_KEY_BYTES];
            var esign_pk = new uint8[Sodium.Asymmetric.Signing.PUBLIC_KEY_BYTES];
            Sodium.Asymmetric.Signing.generate_keypair(esign_pk, esign_sk);

            // Encryption sealing (X25519) key pair.
            var seal_sk = new uint8[Sodium.Asymmetric.Sealing.SECRET_KEY_BYTES];
            var seal_pk = new uint8[Sodium.Asymmetric.Sealing.PUBLIC_KEY_BYTES];
            Sodium.Asymmetric.Sealing.generate_keypair(seal_pk, seal_sk);

            stdout.printf("{\n");
            stdout.printf("  \"statum\": {\n");
            stdout.printf("    \"signing_secret_key\": \"%s\",\n", Base64.encode(sign_sk));
            stdout.printf("    \"signing_public_key\": \"%s\",\n", Base64.encode(sign_pk));
            stdout.printf("    \"encryption_signing_secret_key\": \"%s\",\n", Base64.encode(esign_sk));
            stdout.printf("    \"encryption_signing_public_key\": \"%s\",\n", Base64.encode(esign_pk));
            stdout.printf("    \"encryption_sealing_secret_key\": \"%s\",\n", Base64.encode(seal_sk));
            stdout.printf("    \"encryption_sealing_public_key\": \"%s\"\n", Base64.encode(seal_pk));
            stdout.printf("  }\n");
            stdout.printf("}\n");

            return 0;
        }
    }
}