5.2 KiB
Keystore
The Infix keystore is a centralized storage system for cryptographic keys used throughout the system. It is based on the IETF standards RFC 9641 (Keystore) and RFC 9640 (Cryptographic Types), with Infix extensions for WiFi and WireGuard key formats.
Overview
The keystore supports two types of cryptographic keys:
-
Asymmetric Keys — public/private key pairs used for:
- SSH host authentication (RSA keys)
- WireGuard VPN tunnels (X25519 keys)
-
Symmetric Keys — shared secrets used for:
- WiFi authentication (WPA2/WPA3 pre-shared keys)
- WireGuard VPN pre-shared keys
All keys are stored under the ietf-keystore configuration path and can be
managed via CLI, NETCONF, or RESTCONF.
Supported Formats
| Asymmetric Key Format | Use Case | Key Type |
|---|---|---|
rsa-private-key-format / ssh-public-key-format |
SSH host keys | RSA |
x25519-private-key-format / x25519-public-key-format |
WireGuard VPN | Curve25519 |
| Symmetric Key Format | Use Case |
|---|---|
passphrase-key-format |
Human-readable passphrases (WiFi) |
octet-string-key-format |
Raw symmetric keys (WireGuard) |
Asymmetric Keys
Asymmetric keys consist of a public/private key pair. The public key can be shared freely, while the private key must be kept secure.
SSH Host Keys
SSH host keys identify the system during SSH and NETCONF connections. The
default host key is automatically generated on first boot and stored in the
keystore with the name genkey.
See SSH Management for details on generating and importing custom SSH host keys.
WireGuard Keys
WireGuard uses X25519 elliptic curve cryptography for key exchange. Each WireGuard interface requires a public/private key pair stored as an asymmetric key in the keystore.
See WireGuard VPN for key generation and configuration examples.
Symmetric Keys
Symmetric keys are shared secrets where the same key must be configured on all systems that need to communicate.
WiFi Pre-Shared Keys
WiFi networks secured with WPA2 or WPA3 use pre-shared keys stored as
symmetric keys in the keystore with passphrase-key-format. The
passphrase must be 8-63 printable ASCII characters.
See WiFi for complete configuration examples.
WireGuard Pre-Shared Keys
WireGuard supports optional pre-shared keys (PSK) that add a layer of
symmetric encryption alongside Curve25519. PSKs use the standard IETF
octet-string-key-format (32 random bytes). This provides defense-in-depth
against future quantum computers that might break elliptic curve cryptography.
Note, however, that WireGuard’s authentication and initial key agreement
remain Curve25519-based, so PSKs only protect the session encryption,
not the handshake itself.
See WireGuard VPN for PSK generation and usage examples.
Viewing Keys
admin@example:/> configure
admin@example:/config/> show keystore
asymmetric-keys {
asymmetric-key genkey {
public-key-format ssh-public-key-format;
public-key MIIBCgKCAQEAm6uCENSafz7mIfIJ8O.... AQAB;
private-key-format rsa-private-key-format;
cleartext-private-key MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYw...b7dyPr4mpHg==;
}
}
Warning
The
show keystorecommand displays private keys in cleartext. Be careful when viewing keys on shared screens or in logged sessions.
To list only asymmetric or symmetric keys:
admin@example:/config/> show keystore asymmetric-keys
admin@example:/config/> show keystore symmetric-keys
Deleting Keys
admin@example:/> configure
admin@example:/config/> delete keystore asymmetric-key mykey
admin@example:/config/> leave
Caution
Deleting a key that is referenced by a service (SSH, WireGuard, WiFi) will cause that service to fail. Verify the key is not in use before deletion.
Security Considerations
The keystore is protected by NACM (Network Access Control Model) rules.
Only users in the admin group can view or modify cryptographic keys.
See NACM for details on access control.
Private keys are stored in cleartext in the configuration database. Configuration files and backups containing the keystore should be treated as sensitive and protected accordingly.
Key Validation
Symmetric key values are stored as binary (base64-encoded). The system validates them based on their declared format:
passphrase-key-format: Used by WiFi, must decode to 8-63 ASCII charactersoctet-string-key-format: Used by Wireguard, must decode to exactly 32 bytes (256 bits)