nkeys

import nkeys from nacl.signing import SigningKey import os # 1. Generate a raw Ed25519 signing key using PyNaCl raw_signing_key = SigningKey.generate() # 2. Encode the raw key as a NATS user seed (e.g., SU...) # The `encode_seed` function combines the raw private key with the NATS prefix. # Use nkeys.PREFIX_BYTE_USER for a user key, nkeys.PREFIX_BYTE_ACCOUNT for an account, etc. user_seed_bytes = nkeys.encode_seed(nkeys.PREFIX_BYTE_USER, raw_signing_key.encode()) print(f"Generated User Seed (NKEY format): {user_seed_bytes.decode()}") # 3. Create an NKEYS KeyPair object from the seed key_pair = nkeys.from_seed(user_seed_bytes) print(f"Public Key (U...): {key_pair.public_key.decode()}") # The private key and seed should be kept secret. # The raw private key is a 64-byte Ed25519 private key. print(f"Private Key (raw hex - keep secret!): {key_pair.private_key.hex()}") print(f"Seed (S... NKEY format - keep secret!): {key_pair.seed.decode()}") # 4. Example of signing data data_to_sign = b"Hello NATS! This is a test message." signature = key_pair.sign(data_to_sign) print(f"Signature for data: {signature.hex()}") # 5. Verification (a KeyPair created from the public key can verify signatures) verifier_key_pair = nkeys.from_public_key(key_pair.public_key) try: verifier_key_pair.verify(data_to_sign, signature) print("Signature verified successfully.") except Exception as e: print(f"Signature verification failed: {e}") # 6. Secure handling: wipe sensitive key material from memory when no longer needed key_pair.wipe() print("Sensitive key material wiped from memory for security.")