> For the complete documentation index, see [llms.txt](https://docs.envector.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.envector.io/1.5.x/key-management/client-managed-keys/key-generation.md). # Key Generation ## 🔑 Managing Keys The `KeyGenerator` is a crucial component for creating and managing the keys required by the system. It allows for the secure generation of key sets, with advanced options for metadata encryption and key sealing to protect sensitive keys at rest. Keys can be generated and managed through both a Command-Line Interface (CLI) and a Python SDK. In addition, key sealing supports the use of a **Key Encryption Key (KEK)**, making it easier to integrate with external Key Management Systems (KMS) for enhanced security. For users who prefer not to manage raw keys themselves, enVector also supports AWS-backed key storage using services such as **Amazon S3** and **AWS Secrets Manager**, so long-term key management can be delegated to AWS instead of the application. > This page covers the **client-managed** model, where the SDK generates and holds the secret keys. For an alternative where the enVector KMS manages the key lifecycle and seals secret keys inside a trusted boundary, see [Managed KMS](/1.5.x/key-management/client-managed-keys.md). For a comparison of the two models, see [Key Management](/1.5.x/key-management/key-management.md). *** ## Generated Key Files When you generate a key set, the following files are created in the specified directory (`//`). * `SecKey.json`: The Secret Key. This is a private key used to decrypt encrypted vectors and derive the public keys. It must be kept confidential and secure at all times. * `EncKey.json`: The Public Encryption Key. This key is used to encrypt vectors before they are sent to the system. It can be shared publicly. * `EvalKey.json`: The Public Evaluation Key. This key enables the server to perform computations (like similarity searches) directly on encrypted data. It is sent to the server during the `register_key` process and is safe to share. By default, it supports vector dimensions up to 4096. * `MetadataKey.json`: The AES Metadata Key. This key is used to encrypt and decrypt metadata associated with your data in the index. It is only generated if `metadata_encryption` is enabled. ```bash ls / EncKey.json EvalKey.json SecKey.json MetadataKey.json ``` *** ## Key Generation Configuration These options control how the keys and their metadata are generated and secured. * `metadata_encryption` (boolean, default: `true`) When enabled, a `MetadataKey.json` is generated. All metadata stored in the index is then encrypted using this AES key before being written, providing an end-to-end security. * `seal_mode` (string, default: `none`) If set to `aes`, this enables key sealing. Sealing encrypts the `SecKey.json` and `MetadataKey.json` files using a Key Encryption Key (KEK). The encrypted keys are saved as `SecKey.json` and `MetadataKey.json`, and the original unsealed key files are no longer used by the system. This provides strong protection for your most sensitive keys at rest. * `seal_path` or `seal_key_stdin` (string) This specifies the Key Encryption Key (KEK) used for sealing when `seal_mode` is `aes`. * `seal_path`: Provides the file path to the KEK. * `seal_key_stdin`: Reads the KEK from standard input instead of a file. This is a more secure method for automated environments (e.g., CI/CD pipelines) as it avoids writing the KEK to disk. *** ## Generating Keys You can generate keys using either the CLI or the Python SDK. ### **Command-Line Interface (CLI)** The `pyenvector-keygen` utility is used for key generation and management from the command line. #### **Example: Generate and Seal Keys** This command generates a key set identified by `ev-key` inside the `keys` directory and seals the secret keys using a KEK from the `aes.kek` file. ``` pyenvector-keygen --key_path keys \ --key_id ev-key \ --metadata_encryption true \ --seal_mode aes \ --seal_key_path aes.kek ``` #### **Example: Supply KEK via Standard Input** For enhanced security, you can pipe the KEK directly to the command, avoiding the need for a file on disk. ``` echo "your-32-byte-kek" | pyenvector-keygen \ --key_path keys \ --key_id ev-key \ --metadata_encryption true \ --seal_mode aes \ --seal_key_stdin ``` *** ### Python SDK The enVector SDK provides two convenient ways to generate keys programmatically. 1\. Using the `KeyGenerator` Class For direct control over key generation, you can use the `KeyGenerator` class. ```python from pyenvector.crypto.key_manager import KeyGenerator # Configure key generation options keygen = KeyGenerator( key_path="keys/ev-key", metadata_encryption=True, seal_mode="aes", seal_kek_path="aes.kek" ) # Generate the key files keygen.generate_keys() ``` 2\. Using the `ev.init()` Helper Function The `ev.init()` function provides a streamlined way to initialize your client environment. It can automatically generate and register keys if they don't already exist, making it ideal for getting started quickly. ```python import pyenvector as ev # Initialize the client, generating keys if the path doesn't exist ev.init( host="your-hostname", port=50050, key_path="./keys", key_id="my-key", metadata_encryption=True, seal_mode="aes", seal_kek_path="aes.kek" ) ``` *** ## AWS-Backed Key Storage Instead of the local filesystem, you can generate keys in memory and store them in **Amazon S3** (public keys) and **AWS Secrets Manager** (secret keys) with `key_store="aws"`. This is covered in a dedicated page — see [AWS-Backed Key Storage](/1.5.x/key-management/client-managed-keys/aws-key-storage.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.envector.io/1.5.x/key-management/client-managed-keys/key-generation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.