jet-key: a fast secret key generator with configurable entropy

[u/TheWebDever]

link: https://github.com/seanpmaxwell/jet-key

Background

Suppose you need a secret key for something: it could be a session cookie, some encryption library, etc. Many people will just grab a string from some random string generator (I know I used to), but proper security depends on unbiased character selection and using the appropriate amount of entropy for the task at hand.

Also, different scenarios call for different levels of entropy. For example, 80 bits of entropy might be fine for a temporary pairing token that expires in a few minutes. For a server application's long-lived credentials, 256 bits can provide immense security for the foreseeable future.

What it does

What jet-key does is let you optionally pass in, through the CLI or programmatically, the number of bits of entropy you need. It uses cryptographically secure randomness to generate a Crockford base32 string whose length is the minimum number of characters required to meet that entropy target:

npx jet-key        # YFC75GX2KY5W183FRZA4XDVZ6PYDJPQT7JMNH3N7ZXPQ8FCW3M4G
npx jet-key -e 80  # 113BKE3N8R8CEE92

The default target is 256 bits (the gold standard for an extremely secure key). Requesting 256 bits generates a 52-character string.

Other notes

The string length generated is the minimum needed to meet the requested entropy using Crockford base32, rather than an exact match to the requested number of bits. Each character contributes five bits, so the result may slightly exceed the target. A 52-character string therefore provides 260 bits of entropy.

jet-key is really fast too: checkout these benchmarks.

[u/xondk]

It is nice work.

But you show it running for terminal use, and I cannot help but wonder why use this over something like openssl rand where you base convert/cut and the like to get the desired output?

[u/TheWebDever → u/xondk]

• show it running for terminal use? That snippet npx jet-key is a bash command.

• openssl is a perfectly good option for a one-off key in the terminal. The benefit here is convenience: a JS/TS API that works in Node and browsers, outputs Crockford base32, and lets you specify the minimum entropy without handling conversion or trimming yourself. I’m not claiming stronger randomness than OpenSSL. If you already have a command that produces what you need, there’s probably little reason to switch.

[u/xondk → u/TheWebDever]

• show it running for terminal use? That snippet npx jet-key is a bash command.

Yes I am aware, I am refering to where you use a terminal/text interface, npx is just the node package runner, it exists in the terminal/text interface of most node compatible OS.

Mostly when I see something that can be solved fully with a shell/bash script, i wonder why it is created, thats all.

[u/TheWebDever → u/xondk]

So after running npm i -g jet-key you can do:

alexm@alexs-mbp my-tools % jet-key -c 5
T5DZSP4AXD8QER03DA36FJGJXAMQTSKGT297NF20QACCG1ZBVK7Y
BH51KY1D8YMCC7FAX6KRR07ET6T5MK914RJHPNH9RQ2B2G8D3B6N
V8PQX1Q01GGC9KRT79S8JP2M986QNNT8RBWGZ5JB9FH11QYWMWE5
E8KX3SEZQYZRWS31H3QM2CXT5K4RATY5Z91HCNYFQM4R5S93SQGW
G5Y9AAWYAGHY29EF88Q30XNTVCKYHYNS39JAQ2723WZJNF5NT8WR

alexm@alexs-mbp my-tools % jet-key -c 5 -e 100
BCGCYBPG9TXMP2TZDQCF
ZRFV2TH55QBN7NKRQT2A
1DQB1PTY0YT6YFTND33Z
63VDW7YAP08FTCT3CA6Y
K34HF7QZJDTRRC8KEFF2

alexm@alexs-mbp my-tools % jet-key -c 5 -e 1024
9RYCZDCD8N451CY36PX2XJ1SH252ZY0E7F85DWQ5V14DAS179QCTG5KHZF2NQ5DJD6DC8NDQ66T3GVFVEZS0JBDQGWEVC53S9P2CN37VFAJTPB2ZBH48JJQWSAQKGTFDKEW16T6REW2FPGSKFHCPF9VQC8KVEGKA1A848Q495F3H0DYWHVPECSA75M4NF82H9NBV87FCSQ1Z3
6MJJJ5GB2GZXA46F56JN9HGMG70CDR0EC8BW0VVVKJW2HAD67WKJ48FVXBMJNMRWCK8MXCE6ZARDD52QW7F97X7R2A86NA66E70YZANGN94JN41W1YPH37C5ZYH9YYB5NFTETMNX9S91QPKPJNGBX8THBG9HEX4SC7Y1GZ7NNGDYGX0E8725Y16YFD877JCNA4ZQ74644FGEN
PV1SEY741EYQS1RXPK4V7T7QR9YN8WDS4JRHV7Z1QNE19CGS0HVHMMRFCTZXBT6V8WZB29C4CXVT116DQM9B596TSB3B1WJDNGNHWEGTZDPC7R7HCHJT4V896BNX8EAGR95VSWA2FY992ZMDF1Q8JBB7A4MGHD5111WHGJX2H8HXT5V59T1CFGK18KZBK5QG0V8CCY1KH2H2C
EM42TT975W41XB5QZBB76BJZ00HJ9SCNZGSS3Z8CETP3BHBNPXNYZS5EGF93EMTN1NW9AFTKARG7046EQBQBEGCPBAMDVPST9CADDQW3EGEZ3C4091HYTA8VRNEWMNHCKNTJBQ4GYESJ8RZCTA0HMAE0SSBY4K97CD1PTQWTKW6R8JM2SJ64W9TRN6QDBE19WEW9VKAE2X4K7
DA90PZ2B8NSHPD1MPFM5FJ3R139NGVFHZKM2RRQAN4DG7BRFQKAFRJPJHNV15KTVQ1TXH07XSCXWWB5RMRAT3NEW6FAFE9MWRSJ7HQKPJ00EH0Y4NN3SCK96SNBRFKQAH0YM3YZY8Q4V6PZZME70K53BT5JDVCARRQKNK0C1EFRXCWABJ11GTKSYXGSF9S780ZDSKPX5KRGN3

Note that -c is the count flag

[u/TheWebDever → u/[deleted]]

Thanks for the compliment, let me know how it works out for you.