diff --git a/doc/keystore.md b/doc/keystore.md index 15c252b3..ca838211 100644 --- a/doc/keystore.md +++ b/doc/keystore.md @@ -22,15 +22,15 @@ managed via CLI, NETCONF, or RESTCONF. ### Supported Formats -| Asymmetric Key Format | Use Case | Key Type | -|----------------------------------------------------------|---------------|------------| -| `rsa-private-key-format` / `ssh-public-key-format` | SSH host keys | RSA | -| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519 | +| **Asymmetric Key Format** | **Use Case** | **Key Type** | +|----------------------------------------------------------|---------------|--------------| +| `rsa-private-key-format` / `ssh-public-key-format` | SSH host keys | RSA | +| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519 | -| Symmetric Key format | Use Case | Key Length | -|----------------------------------|----------------|------------------------| -| `wifi-preshared-key-format` | WiFi WPA2/WPA3 | 8-63 characters | -| `wireguard-symmetric-key-format` | WireGuard PSK | 44 characters (base64) | +| **Symmetric Key Format** | **Use Case** | +|-----------------------------|-----------------------------------| +| `passphrase-key-format` | Human-readable passphrases (WiFi) | +| `octet-string-key-format` | Raw symmetric keys (WireGuard) | ## Asymmetric Keys @@ -63,15 +63,16 @@ all systems that need to communicate. ### WiFi Pre-Shared Keys WiFi networks secured with WPA2 or WPA3 use pre-shared keys stored as -symmetric keys in the keystore. The key must be 8-63 printable ASCII -characters. +symmetric keys in the keystore with `passphrase-key-format`. The +passphrase must be 8-63 printable ASCII characters. See [WiFi](wifi.md) for complete configuration examples. ### WireGuard Pre-Shared Keys WireGuard supports optional pre-shared keys (PSK) that add a layer of -symmetric encryption alongside Curve25519. This provides defense-in-depth +symmetric encryption alongside Curve25519. PSKs use the standard IETF +`octet-string-key-format` (32 random bytes). This provides defense-in-depth against future quantum computers that might break elliptic curve cryptography. Note, however, that WireGuard’s authentication and initial key agreement remain Curve25519-based, so PSKs only protect the session encryption, @@ -126,12 +127,11 @@ as sensitive and protected accordingly. ### Key Validation -The keystore validates symmetric keys based on their declared format: +Symmetric key values are stored as binary (base64-encoded). The system +validates them based on their declared format: -- **WiFi PSK**: Must be 8-63 characters -- **WireGuard PSK**: Must be exactly 44 characters (base64-encoded) - -Invalid keys are rejected at configuration time. +- `passphrase-key-format`: Used by WiFi, must decode to 8-63 ASCII characters +- `octet-string-key-format`: Used by Wireguard, must decode to exactly 32 bytes (256 bits) ## References diff --git a/doc/vpn-wireguard.md b/doc/vpn-wireguard.md index 8de89d34..f5613f81 100644 --- a/doc/vpn-wireguard.md +++ b/doc/vpn-wireguard.md @@ -406,8 +406,8 @@ cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m= 
admin@example:/> configure
 admin@example:/config/> edit keystore symmetric-key wg-psk
-admin@example:/config/keystore/symmetric-key/wg-psk/> set key-format wireguard-symmetric-key-format
-admin@example:/config/keystore/symmetric-key/wg-psk/> set symmetric-key cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=
+admin@example:/config/keystore/symmetric-key/wg-psk/> set key-format octet-string-key-format
+admin@example:/config/keystore/symmetric-key/wg-psk/> set cleartext-symmetric-key cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=
 admin@example:/config/keystore/symmetric-key/wg-psk/> end
 admin@example:/config/interface/wg0/> edit wireguard peers wg-peers peer remote
 admin@example:/config/interface/…/wg-peers/peer/remote/> set preshared-key wg-psk
diff --git a/doc/wifi.md b/doc/wifi.md
index 73190f3f..8d1e8e1a 100644
--- a/doc/wifi.md
+++ b/doc/wifi.md
@@ -253,8 +253,8 @@ Create a keystore entry for your WiFi password (8-63 characters):
 
 
admin@example:/> configure
 admin@example:/config/> edit keystore symmetric-key my-wifi-key
-admin@example:/config/keystore/…/my-wifi-key/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/my-wifi-key/> set symmetric-key MyPassword123
+admin@example:/config/keystore/…/my-wifi-key/> set key-format passphrase-key-format
+admin@example:/config/keystore/…/my-wifi-key/> set cleartext-symmetric-key TXlQYXNzd29yZDEyMw==
 admin@example:/config/keystore/…/my-wifi-key/> leave
 

 
@@ -310,8 +310,8 @@ create a keystore entry for your WiFi password and configure the AP interface:
 
 
admin@example:/> configure
 admin@example:/config/> edit keystore symmetric-key my-wifi-secret
-admin@example:/config/keystore/…/my-wifi-secret/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/my-wifi-secret/> set symmetric-key MySecurePassword123
+admin@example:/config/keystore/…/my-wifi-secret/> set key-format passphrase-key-format
+admin@example:/config/keystore/…/my-wifi-secret/> set cleartext-symmetric-key TXlTZWN1cmVQYXNzd29yZDEyMw==
 admin@example:/config/keystore/…/my-wifi-secret/> end
 

 
@@ -371,14 +371,14 @@ admin@example:/config/hardware/component/radio0/wifi-radio/> leave
 
 
admin@example:/> configure
 admin@example:/config/> edit keystore symmetric-key main-secret
-admin@example:/config/keystore/…/main-secret/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/main-secret/> set symmetric-key MyMainPassword
+admin@example:/config/keystore/…/main-secret/> set key-format passphrase-key-format
+admin@example:/config/keystore/…/main-secret/> set cleartext-symmetric-key TXlNYWluUGFzc3dvcmQ=
 admin@example:/config/> edit keystore symmetric-key guest-secret
-admin@example:/config/keystore/…/guest-secret/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/guest-secret/> set symmetric-key GuestPassword123
+admin@example:/config/keystore/…/guest-secret/> set key-format passphrase-key-format
+admin@example:/config/keystore/…/guest-secret/> set cleartext-symmetric-key R3Vlc3RQYXNzd29yZDEyMw==
 admin@example:/config/> edit keystore symmetric-key iot-secret
-admin@example:/config/keystore/…/iot-secret/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/iot-secret/> set symmetric-key IoTDevices2025
+admin@example:/config/keystore/…/iot-secret/> set key-format passphrase-key-format
+admin@example:/config/keystore/…/iot-secret/> set cleartext-symmetric-key SW9URGV2aWNlczIwMjU=
 admin@example:/config/keystore/…/iot-secret/> leave