Skip to content

kek v0.2.0 — clap rewrite, base58 scheme, and `kek` binary

Latest
Latest

Choose a tag to compare

View all tags
@codebender828 codebender828 released this 15 May 11:13
v0.2.0
71939fe

First production-ready release of kek, the KMS Encryption Kit.

Highlights

  • 🆕 Two encryption schemes. Pick the one whose decoded plaintext matches your downstream consumer:
    • bytes: keypair_bytes → base64 → KMS encrypt (decrypts to a 64-byte UInt8Array).
    • base58: base58_string → base64 → KMS encrypt (decrypts to a Phantom-style base58 private key string).
  • 🆕 Proper subcommand CLI built on clap derive — kek --help documents every operation.
  • 🆕 serialize-base58 subcommand converts an id.json to a base58 private key string without touching KMS (replaces the previous TypeScript helper).
  • 🆕 Install via install.sh — one-liner that delegates to cargo install --git. Pin a tag with KEK_REF=v0.2.0.

Commands

Command Purpose
encrypt-keypair Encrypt id.json as raw bytes (UInt8Array → base64 → KMS)
encrypt-keypair-base58 Encrypt id.json as a base58 string (base58 → base64 → KMS)
decrypt-keypair (alias decrypt) Decrypt a bytes-scheme ciphertext
decrypt-keypair-base58 Decrypt a base58-scheme ciphertext
encrypt-message / decrypt-message Encrypt/decrypt arbitrary UTF-8 strings
serialize-base58 Print id.json as a base58 private key (no KMS)

Install

curl -fsSL https://raw.githubusercontent.com/mirrorworld-universe/solana-kms-keypair-encryption-kit/main/install.sh | KEK_REF=v0.2.0 bash

Requires cargo (https://rustup.rs). The binary lands at ~/.cargo/bin/kek.

Security

  • Hardened .gitignore blocks id.json, *.keypair.json, keypair*.json, *.secret, *.log, and .env*.
  • Live KMS round-trip test now reads KMS_TEST_KEY_ID from the environment instead of a hard-coded value.
  • Verbose AWS metadata (KMS region, SDK version) is no longer printed on every operation.

See README.md → Security notes for guidance on stdout redirection, IAM scope, and zeroization caveats.

Breaking changes

  • The CLI used to accept kms-encryption-kit <path> <pubkey> as the default invocation. It now requires the explicit encrypt-keypair (or encrypt-keypair-base58) subcommand.
  • The binary is now installed as kek rather than kms-encryption-kit.
  • decrypt still works — it is now a visible alias of decrypt-keypair.

Acknowledgements

Special thanks to the team who flagged the bytes-vs-base58 ambiguity that motivated the dual-scheme design.

Assets 2
Loading