<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Key Management

## openssl Key Generation

| Command | Purpose |
|---|---|
| `openssl rand -hex 32` | 256-bit random symmetric key |
| `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096` | RSA-4096 key |
| `openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256` | ECDSA P-256 key |
| `openssl genpkey -algorithm ed25519` | Ed25519 signing key |

## AWS KMS

| Command | Description |
|---|---|
| `aws kms create-key` | Create a new KMS key |
| `aws kms encrypt --key-id <id> --plaintext fileb://<file>` | Encrypt data |
| `aws kms decrypt --ciphertext-blob fileb://<file>` | Decrypt data |
| `aws kms enable-key-rotation --key-id <id>` | Enable annual rotation |
| `aws kms generate-data-key --key-id <id> --key-spec AES_256` | Envelope encryption DEK |
| `aws kms list-keys` | List all KMS keys |

## HashiCorp Vault Transit

| Command | Description |
|---|---|
| `vault secrets enable transit` | Enable transit engine |
| `vault write -f transit/keys/<name>` | Create encryption key |
| `vault write transit/encrypt/<name> plaintext=<b64>` | Encrypt |
| `vault write transit/decrypt/<name> ciphertext=<ct>` | Decrypt |
| `vault write -f transit/keys/<name>/rotate` | Rotate key version |
| `vault read transit/keys/<name>` | Key metadata |

## Azure Key Vault

| Command | Description |
|---|---|
| `az keyvault key create --vault-name <v> --name <n>` | Create key |
| `az keyvault key list --vault-name <v>` | List keys |
| `az keyvault key rotate --vault-name <v> --name <n>` | Rotate key |

## Agent Script

```bash
# Generate AES-256 key
node agent.js generate --algorithm aes256

# Generate Ed25519 key
node agent.js generate --algorithm ed25519 --output signing.pem

# Check system entropy
node agent.js entropy

# Vault key info
node agent.js vault-info app-key

# Rotate Vault key
node agent.js vault-rotate app-key

# List AWS KMS keys
node agent.js aws-list

# Audit for plaintext keys
node agent.js audit /path/to/project
```
