Keytool

1 命令说明

sui keytool的子命令集主要是涉及私钥相关的命令行工具，包括私钥创建、签名验签、单签多签及zkLogin相关命令等。

可通过help/-h获取完整的子命令：

Sui keystore tool

Usage: sui keytool [OPTIONS] <COMMAND>

Commands:
  update-alias                             Update an old alias to a new one. If a new alias is not provided, a random one
                                               will be generated
  convert                                  Convert private key in Hex or Base64 to new format (Bech32 encoded 33 byte flag
                                               || private key starting with "suiprivkey"). Hex private key format import and
                                               export are both deprecated in Sui Wallet and Sui CLI Keystore. Use `sui keytool
                                               import` if you wish to import a key to Sui Keystore
  decode-or-verify-tx                      Given a Base64 encoded transaction bytes, decode its components. If a signature
                                               is provided, verify the signature against the transaction and output the result
  decode-multi-sig                         Given a Base64 encoded MultiSig signature, decode its components. If tx_bytes is
                                               passed in, verify the multisig
  generate                                 Generate a new keypair with key scheme flag {ed25519 | secp256k1 | secp256r1}
                                               with optional derivation path, default to m/44'/784'/0'/0'/0' for ed25519 or
                                               m/54'/784'/0'/0/0 for secp256k1 or m/74'/784'/0'/0/0 for secp256r1. Word length
                                               can be { word12 | word15 | word18 | word21 | word24} default to word12 if not
                                               specified
  import                                   Add a new key to Sui CLI Keystore using either the input mnemonic phrase or a
                                               Bech32 encoded 33-byte `flag || privkey` starting with "suiprivkey", the key
                                               scheme flag {ed25519 | secp256k1 | secp256r1} and an optional derivation path,
                                               default to m/44'/784'/0'/0'/0' for ed25519 or m/54'/784'/0'/0/0 for secp256k1 or
                                               m/74'/784'/0'/0/0 for secp256r1. Supports mnemonic phrase of word length 12, 15,
                                               18, 21, 24. Set an alias for the key with the --alias flag. If no alias is
                                               provided, the tool will automatically generate one
  export                                   Output the private key of the given key identity in Sui CLI Keystore as Bech32
                                               encoded string starting with `suiprivkey`
  list                                     List all keys by its Sui address, Base64 encoded public key, key scheme name in
                                               sui.keystore
  load-keypair                             This reads the content at the provided file path. The accepted format can be
                                               [enum SuiKeyPair] (Base64 encoded of 33-byte `flag || privkey`) or `type
                                               AuthorityKeyPair` (Base64 encoded `privkey`). This prints out the account keypair
                                               as Base64 encoded `flag || privkey`, the network keypair, worker keypair,
                                               protocol keypair as Base64 encoded `privkey`
  multi-sig-address                        To MultiSig Sui Address. Pass in a list of all public keys `flag || pk` in
                                               Base64. See `keytool list` for example public keys
  multi-sig-combine-partial-sig            Provides a list of participating signatures (`flag || sig || pk` encoded in
                                               Base64), threshold, a list of all public keys and a list of their weights that
                                               define the MultiSig address. Returns a valid MultiSig signature and its sender
                                               address. The result can be used as signature field for `sui client
                                               execute-signed-tx`. The sum of weights of all signatures must be >= the threshold
  multi-sig-combine-partial-sig-legacy     
  show                                     Read the content at the provided file path. The accepted format can be [enum
                                               SuiKeyPair] (Base64 encoded of 33-byte `flag || privkey`) or `type
                                               AuthorityKeyPair` (Base64 encoded `privkey`). It prints its Base64 encoded public
                                               key and the key scheme flag
  sign                                     Create signature using the private key for for the given address (or its alias)
                                               in sui keystore. Any signature commits to a [struct IntentMessage] consisting of
                                               the Base64 encoded of the BCS serialized transaction bytes itself and its intent.
                                               If intent is absent, default will be used
  sign-kms                                 Creates a signature by leveraging AWS KMS. Pass in a key-id to leverage Amazon
                                               KMS to sign a message and the base64 pubkey. Generate PubKey from pem using
                                               MystenLabs/base64pemkey Any signature commits to a [struct IntentMessage]
                                               consisting of the Base64 encoded of the BCS serialized transaction bytes itself
                                               and its intent. If intent is absent, default will be used
  unpack                                   This takes [enum SuiKeyPair] of Base64 encoded of 33-byte `flag || privkey`). It
                                               outputs the keypair into a file at the current directory where the address is the
                                               filename, and prints out its Sui address, Base64 encoded public key, the key
                                               scheme, and the key scheme flag
  zk-login-sign-and-execute-tx             Given the max_epoch, generate an OAuth url, ask user to paste the redirect with
                                               id_token, call salt server, then call the prover server, create a test
                                               transaction, use the ephemeral key to sign and execute it by assembling to a
                                               serialized zkLogin signature
  zk-login-enter-token                     A workaround to the above command because sometimes token pasting does not work
                                               (for Facebook). All the inputs required here are printed from the command above
  zk-login-sig-verify                      Given a zkLogin signature, parse it if valid. If `bytes` provided, parse it as
                                               either as TransactionData or PersonalMessage based on `intent_scope`. It verifies
                                               the zkLogin signature based its latest JWK fetched. Example request: sui keytool
                                               zk-login-sig-verify --sig $SERIALIZED_ZKLOGIN_SIG --bytes $BYTES --intent-scope 0
                                               --network devnet --curr-epoch 10
  zk-login-insecure-sign-personal-message  TESTING ONLY: Generate a fixed ephemeral key and its JWT token with test issuer.
                                               Produce a zklogin signature for the given data and max epoch. e.g. sui keytool
                                               zk-login-insecure-sign-personal-message --data "hello" --max-epoch 5

2 命令分类

根据命令实现功能分为以下几类：

2.1 密钥对类

子命令	功能说明
`generate`	生成密钥对
`show`	查看密钥
`unpack`	解码密钥
`convert`	密钥格式转换
`import`	导入私钥到`Sui CLI Keystore`
`export`	导出私钥
`list`	列出本地`Keystore`所有私钥对应的地址及公钥等信息
`update-alias`	更新别名
`load-keypair`	加载多种类型的密钥对

2.2 单签类

子命令	功能说明
`sign`	交易签名
`decode-or-verify-tx`	交易解码或签名交易验签

2.3 多签类

子命令	功能说明
`multi-sig-address`	创建多重签名地址
`multi-sig-combine-partial-sig`	合并签名
`decode-multi-sig`	多签解码

2.4 zkLogin类

子命令	功能说明
`zk-login-sign-and-execute-tx`	zkLogin登录、验签、执行接口
`zk-login-sig-verify`	zkLogin签名验证

3 命令详解

3.1 链网络类

3.1.1 `generate`：生成密钥对

(1) 命令说明

执行该命令可以生成新密钥对，用户可以指定密钥方案和派生路径，若不指定将使用默认值，默认助记词长度为12个单词

Generate a new keypair with key scheme flag {ed25519 | secp256k1 | secp256r1} with optional derivation path, default to m/44'/784'/0'/0'/0' for ed25519 or m/54'/784'/0'/0/0 for secp256k1 or m/74'/784'/0'/0/0 for secp256r1. Word length can be { word12 | word15 | word18 | word21 | word24} default to word12 if not specified

Usage: sui keytool generate [OPTIONS] <KEY_SCHEME> [DERIVATION_PATH] [WORD_LENGTH]

Arguments:
  <KEY_SCHEME>
  [DERIVATION_PATH]
  [WORD_LENGTH]

KEY SCHEME	DEFAULT DERIVATION PATH
`ed25519`	`m/44'/784'/0'/0'/0'`
`secp256k1`	`m/54'/784'/0'/0/0`
`secp256r1`	`m/74'/784'/0'/0/0`

(2) 命令使用

直接创建

$ sui keytool generate ed25519
╭─────────────────┬────────────────────────────────────────────────────────────────────────────────────────────╮
│ alias           │                                                                                            │
│ suiAddress      │  0x0ab645b6d1c536534a6a2cf4616390a8f4922b0f8b127e494a7eb9fdde70acc4                        │
│ publicBase64Key │  AGwzSkAPgy3Pkgl+ZFVZWfdFQz9COw46z4RX2WKCRY4a                                              │
│ keyScheme       │  ed25519                                                                                   │
│ flag            │  0                                                                                         │
│ mnemonic        │  fetch mushroom celery actress capital clip update neutral kangaroo deal picture identify  │
│ peerId          │  6c334a400f832dcf92097e64555959f745433f423b0e3acf8457d96282458e1a                          │
╰─────────────────┴────────────────────────────────────────────────────────────────────────────────────────────╯

# 本地生成私钥文件
$ cat 0x0ab645b6d1c536534a6a2cf4616390a8f4922b0f8b127e494a7eb9fdde70acc4.key 
AEXleFEKuJrNh9E3kpvwLqdsfeQfuliUQQ61cvJVfq4N

指定派生路径和助记词长度创建

$ sui keytool generate secp256k1 "m/54'/784'/0'/0/0" word15
╭─────────────────┬────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ alias           │                                                                                                        │
│ suiAddress      │  0x5f5bc9a9d12da2210ad43be0d8120989c280a409e2bed53691a05ca505c8f93a                                    │
│ publicBase64Key │  AQNxN3EAZbPLFUNT9z8HgnaNlRumUvGSmawdr1igYMVCrg==                                                      │
│ keyScheme       │  secp256k1                                                                                             │
│ flag            │  1                                                                                                     │
│ mnemonic        │  over shaft village combine puzzle muscle fantasy relief early select acquire boy tourist hybrid fine  │
│ peerId          │                                                                                                        │
╰─────────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────────╯

# 本地生成私钥文件
$ cat 0x5f5bc9a9d12da2210ad43be0d8120989c280a409e2bed53691a05ca505c8f93a.key 
Af+2Y9EdQuFUUePBcUfbJHduivR+cg794FrmrvBS1rXf

move cookbook