enigmastick

Software / Device operations

Enigma CLI.

A direct line to the stick. Inspect its state, manage keys, and experiment with cryptographic operations from your terminal.

Source status

Build from source

The source repository is not public yet. These commands apply once you have a source checkout. The current Go module declares Go 1.26.0.

Terminal
cd enigma-cli
go build -o enigma-cli .
./enigma-cli --help

Examples below assume the binary is on your PATH. You can use ./enigma-cli from its build directory instead.

Check the connection

Terminal
enigma-cli status
enigma-cli authenticate
enigma-cli list-keys
enigma-cli lock

Authentication prompts for the PIN. Unlocking creates a reusable session on the device, which can serve multiple commands until explicitly locked or closed by inactivity. Closing a CLI process does not itself lock the token.

The current CLI has no initialization command. These examples assume an already provisioned token. See getting started for the current provisioning boundary.

Create and inspect keys

The following command creates a persistent AES key on the device. Choose a label that makes sense for your application.

Terminal
enigma-cli authenticate
enigma-cli generate-key --type AES --size 256 \
  --usage ENCRYPT --label file-key
enigma-cli list-keys --label file-key
enigma-cli lock

Key labels need not be unique. Use the returned key ID for operations that take --key-id. IDs can be reused after deletion.

Command guide

CommandPurpose
statusRead token and session state.
authenticate / lockOpen or close the authenticated device session.
generate-keyCreate an AES, HMAC, RSA, or EC key.
list-keysFilter metadata by type, usage, label, or ID.
exportWrite a public key in DER or PEM form.
signCreate a signature or HMAC.
verifyVerify an HMAC on the device.
encrypt / decryptOperate on bounded messages; see the supported mechanisms.
ecdhDerive a persistent AES key from EC key agreement.
destroy-keyPermanently delete a customer key.

Run enigma-cli <command> --help for flags. Direct device encryption has bounded payloads; use Seal for the file-encryption workflow.

Keep exploring

See keys and sessions for authentication behavior, and mechanisms for algorithm choices and encodings.