Struct KeyManager 

pub struct KeyManager;

Main interface for key management operations

This is the recommended API for library integration. It provides simple, safe methods for common key operations.

Implementations

impl KeyManager

pub fn generate_keypair() -> Keypair

Generate a new Solana keypair

Example

use fnzero_safe::KeyManager;
use solana_sdk::signature::Signer;

let keypair = KeyManager::generate_keypair();
println!("Public key: {}", keypair.pubkey());

pub fn encrypt_with_password( private_key: &str, password: &str, ) -> EncryptionResult<String>

Encrypt a private key with a password

Arguments

• private_key - The private key in base58 string format
• password - The password to use for encryption

Returns

A serialized authenticated v2 keystore envelope

Example

use fnzero_safe::KeyManager;

let keypair = KeyManager::generate_keypair();
let private_key = keypair.to_base58_string();

let encrypted = KeyManager::encrypt_with_password(
    &private_key,
    "my_password"
).unwrap();

pub fn encrypt_secret_with_password( secret: &str, password: &str, ) -> EncryptionResult<String>

Encrypt arbitrary UTF-8 secret material in an authenticated, password-derived envelope.

pub fn decrypt_secret_with_password( encrypted_data: &str, password: &str, ) -> EncryptionResult<String>

Decrypt an authenticated UTF-8 secret envelope.

pub fn decrypt_with_password( encrypted_data: &str, password: &str, ) -> EncryptionResult<String>

Decrypt a private key with a password

Arguments

• encrypted_data - A v2 envelope or legacy v1 ciphertext
• password - The password used for encryption

Returns

The original private key in base58 string format

Example

use fnzero_safe::KeyManager;

let keypair = KeyManager::generate_keypair();
let private_key = keypair.to_base58_string();
let encrypted = KeyManager::encrypt_with_password(
    &private_key,
    "my_password"
).unwrap();
let decrypted = KeyManager::decrypt_with_password(
    &encrypted,
    "my_password"
).unwrap();
assert_eq!(decrypted, private_key);

pub fn get_public_key(private_key: &str) -> EncryptionResult<String>

Get public key from a private key

Arguments

• private_key - Private key in base58 string format

Returns

Public key as a base58 string

pub fn keypair_to_encrypted_json( keypair: &Keypair, password: &str, ) -> EncryptionResult<String>

Encrypt a keypair to a JSON keystore format

This creates a fnzero-safe v2 password keystore.

Arguments

• keypair - The Solana keypair to encrypt
• password - The password for encryption

Returns

JSON string containing the encrypted keystore

pub fn mnemonic_to_encrypted_json( mnemonic: &str, derivation_path: &str, password: &str, ) -> EncryptionResult<String>

Encrypt a BIP-39 mnemonic as the primary keystore secret.

pub fn keypair_from_mnemonic( mnemonic: &str, derivation_path: &str, ) -> EncryptionResult<Keypair>

Derive a Solana keypair from a BIP-39 mnemonic and absolute path.

pub fn mnemonic_from_encrypted_json( json_data: &str, password: &str, ) -> EncryptionResult<Zeroizing<String>>

Decrypt the mnemonic from a v3 mnemonic keystore.

pub fn keystore_version(json_data: &str) -> EncryptionResult<KeystoreVersion>

Detect the supported password-keystore format without decrypting it.

pub fn keypair_from_encrypted_json_v2( json_data: &str, password: &str, ) -> EncryptionResult<Keypair>

Decrypt a supported v2 keystore, rejecting legacy unauthenticated formats.

pub fn keypair_from_encrypted_json( json_data: &str, password: &str, ) -> EncryptionResult<Keypair>

Decrypt a password keystore. Legacy v1 support is read-only.

Examples found in repository

examples/test_decrypt.rs (line 99)

fn main() {
    let args: Vec<String> = std::env::args().collect();
    let password = if args.len() >= 2 {
        args[1].clone()
    } else {
        eprintln!("Usage: cargo run -p fnzero-safe-core --example test_decrypt <password>");
        std::process::exit(1);
    };

    let keystore_path = if args.len() >= 3 {
        args[2].clone()
    } else {
        "config/dev/keystore.json".to_string()
    };

    let content = std::fs::read_to_string(&keystore_path).unwrap_or_else(|e| {
        eprintln!("Failed to read {}: {}", keystore_path, e);
        std::process::exit(1);
    });

    let data: serde_json::Value = serde_json::from_str(&content).unwrap();
    let encrypted = data["encrypted_private_key"].as_str().unwrap();
    let pubkey = data["public_key"].as_str().unwrap();

    eprintln!("Keystore: {}", keystore_path);
    eprintln!("Public key: {}", pubkey);
    eprintln!("Password len: {}", password.len());

    let key = generate_encryption_key_simple(&password);
    eprintln!(
        "Encryption key: {:02x}{:02x}{:02x}{:02x}...",
        key[0], key[1], key[2], key[3]
    );

    match decrypt_key_to_bytes(encrypted, &key) {
        Ok(bytes) => {
            let preview: Vec<String> = bytes
                .iter()
                .take(16)
                .map(|b| format!("{:02x}", b))
                .collect();
            eprintln!(
                "Decrypted {} bytes, first 16: {}",
                bytes.len(),
                preview.join(" ")
            );
            eprintln!("is_ascii: {}", bytes.iter().all(|b| b.is_ascii()));
            eprintln!("is_utf8: {}", String::from_utf8(bytes.clone()).is_ok());

            // Check if it looks like base58
            let all_base58 = bytes.iter().all(|b| {
                let c = *b as char;
                c.is_ascii()
                    && (('1'..='9').contains(&c)
                        || ('A'..='H').contains(&c)
                        || ('J'..='N').contains(&c)
                        || ('P'..='Z').contains(&c)
                        || c.is_ascii_lowercase())
            });
            eprintln!("all_base58_chars: {}", all_base58);
        }
        Err(e) => eprintln!("decrypt_key_to_bytes failed: {}", e),
    }

    // Also try with trimmed password
    let trimmed = password.trim();
    if trimmed != password {
        eprintln!("\n--- Trying trimmed password (len={}) ---", trimmed.len());
        let key2 = generate_encryption_key_simple(trimmed);
        eprintln!(
            "Encryption key: {:02x}{:02x}{:02x}{:02x}...",
            key2[0], key2[1], key2[2], key2[3]
        );

        match decrypt_key_to_bytes(encrypted, &key2) {
            Ok(bytes) => {
                let preview: Vec<String> = bytes
                    .iter()
                    .take(16)
                    .map(|b| format!("{:02x}", b))
                    .collect();
                eprintln!(
                    "Decrypted {} bytes, first 16: {}",
                    bytes.len(),
                    preview.join(" ")
                );
                eprintln!("is_ascii: {}", bytes.iter().all(|b| b.is_ascii()));
                eprintln!("is_utf8: {}", String::from_utf8(bytes.clone()).is_ok());
            }
            Err(e) => eprintln!("decrypt failed: {}", e),
        }

        match KeyManager::keypair_from_encrypted_json(&content, trimmed) {
            Ok(kp) => {
                println!("SUCCESS with trimmed! keypair: {}", kp.pubkey());
                if kp.pubkey().to_string() == pubkey {
                    println!("Public key MATCHES!");
                }
            }
            Err(e) => eprintln!("keypair_from_encrypted_json (trimmed) failed: {}", e),
        }
    }

    match KeyManager::keypair_from_encrypted_json(&content, &password) {
        Ok(kp) => {
            println!("SUCCESS! keypair: {}", kp.pubkey());
            if kp.pubkey().to_string() == pubkey {
                println!("Public key MATCHES!");
            } else {
                println!("WARNING: mismatch! expected {}", pubkey);
            }
        }
        Err(e) => eprintln!("keypair_from_encrypted_json failed: {}", e),
    }
}

pub fn migrate_encrypted_json_to_v2( json_data: &str, legacy_password: &str, new_password: &str, ) -> EncryptionResult<String>

Explicitly decrypt a legacy v1 keystore and re-encrypt it as v2.

pub fn migrate_encrypted_json_to_v2_with_public_key( json_data: &str, legacy_password: &str, new_password: &str, ) -> EncryptionResult<(String, String)>

Explicitly migrate legacy v1 and return the public key verified from plaintext.