Keytool — Secure AES Key Encryption & TLS Injection CLI Tool

Overview

keytool is a TypeScript-based CLI utility for managing encrypted secrets, such as private keys, and securely injecting them into applications via a TLS channel. It provides the following features:

• AES-256-CBC encryption/decryption of key-value pairs (e.g. private keys)
• Secure TLS server to receive and manage secrets
• CLI-based injector client that pushes secrets over TLS
• Heartbeat mechanism to ensure secrets are fresh and connection is alive
• Self-signed certificate generation tool

Project Structure

.
├── src/
│   ├── cli.ts
│   ├── crypto/
│   │   ├── encrypt.ts
│   │   ├── decrypt.ts
│   ├── commands/
│   │   ├── inject.ts
│   │   ├── serve.ts
│   │   └── generateCert.ts
│   ├── utils/
│       └── crypto.ts
├── makers.json               # Input plain-text key-value file
├── makers.encrypted.json     # Encrypted output file
├── package.json
├── tsconfig.json
├── README.md

Installation

Install dependencies:

npm install

Build the project:

npm run build

You can run it directly via npx or install globally:

npx orbiter-keytool <command>

CLI Usage

Command format

npx orbiter-keytool <command> [options]

Available Commands

| Command | Description | |------------------|----------------------------------------------| | encrypt | Encrypt key-value pairs from JSON | | decrypt | Decrypt key-value pairs from encrypted JSON | | inject | Inject encrypted secrets over TLS with heartbeat | | serve | Start a secure server to receive secrets | | generate-cert | Generate a self-signed TLS certificate |

Commands & Examples

🔐 encrypt

Encrypts a key-value JSON file using AES-256-CBC.

npx orbiter-keytool encrypt --key "yourMasterKey" --input makers.json --output makers.encrypted.json

🔓 decrypt

Decrypts an encrypted key-value JSON file.

npx orbiter-keytool decrypt --key "yourMasterKey" --input makers.encrypted.json

🚀 inject

Continuously sends keys from .env to the server with heartbeat monitoring.

npx orbiter-keytool inject --cert ./cert.pem --token yourToken --env .env --interval 30

.env file format:

0xabc...=privatekey1
0xdef...=privatekey2

🛡️ serve

Starts a TLS server and receives keys from injectors.

npx orbiter-keytool serve --cert ./cert.pem --key ./key.pem --token yourToken --port 8000 --timeout 90

• token must match between server and injector.
• timeout is the heartbeat inactivity timeout (seconds).

🔧 generate-cert

Generates a self-signed TLS cert for testing or internal use.

npx orbiter-keytool generate-cert --out ./certs --common-name localhost

JSON Formats

makers.json

{
    "0xabc...": "privatekey1",
    "0xdef...": "privatekey2"
}

makers.encrypted.json

{
    "0xabc...": "iv_hex:encrypted_data_hex",
    "0xdef...": "iv_hex:encrypted_data_hex"
}

Security Notes

• Avoid passing secrets via CLI directly to prevent exposure via shell history.
• Use .env files or prompt-based entry where possible.
• TLS is mandatory for key injection to ensure end-to-end encryption.
• Make sure your TLS certs are secured and not exposed.

Development

To build the project:

npm run build

To publish to npm:

• Ensure package.json includes files or .npmignore
• Run:

npm login
npm publish --access public

License

MIT License

Contact

• GitHub: https://github.com/orgs/Orbiter-Finance
• Email: [email protected]