peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-30 04:33:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

doc: update docs with keystore format changes

Browse Source 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2026-02-02 17:50:09 +01:00
parent 74a09d2c1b
commit 94808331da
3 changed files with 28 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/keystore.md
+16 -16
View File
@@ -22,15 +22,15 @@ managed via CLI, NETCONF, or RESTCONF.
### Supported Formats
| Asymmetric Key Format | Use Case | Key Type |
|----------------------------------------------------------|---------------|------------|
| `rsa-private-key-format` / `ssh-public-key-format` | SSH host keys | RSA |
| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519 |
| **Asymmetric Key Format** | **Use Case** | **Key Type** |
|----------------------------------------------------------|---------------|--------------|
| `rsa-private-key-format` / `ssh-public-key-format` | SSH host keys | RSA |
| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519 |
| Symmetric Key format | Use Case | Key Length |
|----------------------------------|----------------|------------------------|
| `wifi-preshared-key-format` | WiFi WPA2/WPA3 | 8-63 characters |
| `wireguard-symmetric-key-format` | WireGuard PSK | 44 characters (base64) |
| **Symmetric Key Format** | **Use Case** |
|-----------------------------|-----------------------------------|
| `passphrase-key-format` | Human-readable passphrases (WiFi) |
| `octet-string-key-format` | Raw symmetric keys (WireGuard) |
## Asymmetric Keys
@@ -63,15 +63,16 @@ all systems that need to communicate.
### WiFi Pre-Shared Keys
WiFi networks secured with WPA2 or WPA3 use pre-shared keys stored as
symmetric keys in the keystore. The key must be 8-63 printable ASCII
characters.
symmetric keys in the keystore with `passphrase-key-format`. The
passphrase must be 8-63 printable ASCII characters.
See [WiFi](wifi.md) for complete configuration examples.
### WireGuard Pre-Shared Keys
WireGuard supports optional pre-shared keys (PSK) that add a layer of
symmetric encryption alongside Curve25519. This provides defense-in-depth
symmetric encryption alongside Curve25519. PSKs use the standard IETF
`octet-string-key-format` (32 random bytes). This provides defense-in-depth
against future quantum computers that might break elliptic curve cryptography.
Note, however, that WireGuard’s authentication and initial key agreement
remain Curve25519-based, so PSKs only protect the session encryption,
@@ -126,12 +127,11 @@ as sensitive and protected accordingly.
### Key Validation
The keystore validates symmetric keys based on their declared format:
Symmetric key values are stored as binary (base64-encoded). The system
validates them based on their declared format:
- **WiFi PSK**: Must be 8-63 characters
- **WireGuard PSK**: Must be exactly 44 characters (base64-encoded)
Invalid keys are rejected at configuration time.
- `passphrase-key-format`: Used by WiFi, must decode to 8-63 ASCII characters
- `octet-string-key-format`: Used by Wireguard, must decode to exactly 32 bytes (256 bits)
## References
doc/vpn-wireguard.md
+2 -2
View File
@@ -406,8 +406,8 @@ cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=
<pre class="cli"><code>admin@example:/> <b>configure</b>
admin@example:/config/> <b>edit keystore symmetric-key wg-psk</b>
admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set key-format wireguard-symmetric-key-format</b>
admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set symmetric-key cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=</b>
admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set key-format octet-string-key-format</b>
admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set cleartext-symmetric-key cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=</b>
admin@example:/config/keystore/symmetric-key/wg-psk/> <b>end</b>
admin@example:/config/interface/wg0/> <b>edit wireguard peers wg-peers peer remote</b>
admin@example:/config/interface/…/wg-peers/peer/remote/> <b>set preshared-key wg-psk</b>
doc/wifi.md
+10 -10
View File
@@ -253,8 +253,8 @@ Create a keystore entry for your WiFi password (8-63 characters):
<pre class="cli"><code>admin@example:/> <b>configure</b>
admin@example:/config/> <b>edit keystore symmetric-key my-wifi-key</b>
admin@example:/config/keystore/…/my-wifi-key/> <b>set key-format wifi-preshared-key-format</b>
admin@example:/config/keystore/…/my-wifi-key/> <b>set symmetric-key MyPassword123</b>
admin@example:/config/keystore/…/my-wifi-key/> <b>set key-format passphrase-key-format</b>
admin@example:/config/keystore/…/my-wifi-key/> <b>set cleartext-symmetric-key TXlQYXNzd29yZDEyMw==</b>
admin@example:/config/keystore/…/my-wifi-key/> <b>leave</b>
</code></pre>
@@ -310,8 +310,8 @@ create a keystore entry for your WiFi password and configure the AP interface:
<pre class="cli"><code>admin@example:/> <b>configure</b>
admin@example:/config/> <b>edit keystore symmetric-key my-wifi-secret</b>
admin@example:/config/keystore/…/my-wifi-secret/> <b>set key-format wifi-preshared-key-format</b>
admin@example:/config/keystore/…/my-wifi-secret/> <b>set symmetric-key MySecurePassword123</b>
admin@example:/config/keystore/…/my-wifi-secret/> <b>set key-format passphrase-key-format</b>
admin@example:/config/keystore/…/my-wifi-secret/> <b>set cleartext-symmetric-key TXlTZWN1cmVQYXNzd29yZDEyMw==</b>
admin@example:/config/keystore/…/my-wifi-secret/> <b>end</b>
</code></pre>
@@ -371,14 +371,14 @@ admin@example:/config/hardware/component/radio0/wifi-radio/> <b>leave</b>
<pre class="cli"><code>admin@example:/> <b>configure</b>
admin@example:/config/> <b>edit keystore symmetric-key main-secret</b>
admin@example:/config/keystore/…/main-secret/> <b>set key-format wifi-preshared-key-format</b>
admin@example:/config/keystore/…/main-secret/> <b>set symmetric-key MyMainPassword</b>
admin@example:/config/keystore/…/main-secret/> <b>set key-format passphrase-key-format</b>
admin@example:/config/keystore/…/main-secret/> <b>set cleartext-symmetric-key TXlNYWluUGFzc3dvcmQ=</b>
admin@example:/config/> <b>edit keystore symmetric-key guest-secret</b>
admin@example:/config/keystore/…/guest-secret/> <b>set key-format wifi-preshared-key-format</b>
admin@example:/config/keystore/…/guest-secret/> <b>set symmetric-key GuestPassword123</b>
admin@example:/config/keystore/…/guest-secret/> <b>set key-format passphrase-key-format</b>
admin@example:/config/keystore/…/guest-secret/> <b>set cleartext-symmetric-key R3Vlc3RQYXNzd29yZDEyMw==</b>
admin@example:/config/> <b>edit keystore symmetric-key iot-secret</b>
admin@example:/config/keystore/…/iot-secret/> <b>set key-format wifi-preshared-key-format</b>
admin@example:/config/keystore/…/iot-secret/> <b>set symmetric-key IoTDevices2025</b>
admin@example:/config/keystore/…/iot-secret/> <b>set key-format passphrase-key-format</b>
admin@example:/config/keystore/…/iot-secret/> <b>set cleartext-symmetric-key SW9URGV2aWNlczIwMjU=</b>
admin@example:/config/keystore/…/iot-secret/> <b>leave</b>
</code></pre>