Keystore

DevOps & Security

keystore

Keystore is an Agent Skill for devops & security published in the Nethereum/Nethereum repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Encrypt and decrypt Ethereum private keys using Web3 Secret Storage (keystore JSON files) with Nethereum. Use this skill whenever the user asks about encrypting private keys, keystore files, Web3 secret storage, Scrypt encryption, PBKDF2, password-protected keys, key encryption, or loading encrypted wallets in C#/.NET.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/Nethereum/Nethereum/blob/HEAD/plugins/nethereum-skills/skills/keystore/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/keystore, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

KeyStore Files with Nethereum

NuGet: Nethereum.KeyStore

dotnet add package Nethereum.KeyStore

Encrypt (Scrypt — recommended)

using Nethereum.KeyStore;
using Nethereum.Signer;

var ecKey = EthECKey.GenerateKey();
var address = ecKey.GetPublicAddress();
var privateKeyBytes = ecKey.GetPrivateKeyAsBytes();

var keyStoreService = new KeyStoreScryptService();
var json = keyStoreService.EncryptAndGenerateKeyStoreAsJson(
    "your-strong-password", privateKeyBytes, address);

File.WriteAllText($"keystore-{address}.json", json);

Custom Scrypt Parameters

// Light: N=32 (fast — for WASM, mobile, tests)
var scryptParams = new ScryptParams { N = 32, R = 8, P = 6 };
var json = keyStoreService.EncryptAndGenerateKeyStoreAsJson(
    "password", privateKeyBytes, address, scryptParams);

Encrypt (PBKDF2 — legacy)

var keyStoreService = new KeyStorePbkdf2Service();
var json = keyStoreService.EncryptAndGenerateKeyStoreAsJson(
    "password", privateKeyBytes, address);

Decrypt

var json = File.ReadAllText("keystore-file.json");

// Auto-detect KDF type
var keyStoreService = new KeyStoreService();
var privateKeyBytes = keyStoreService.DecryptKeyStoreFromJson("your-password", json);
var account = new Nethereum.Web3.Accounts.Account(privateKeyBytes, chainId: 1);

Detect KDF Type

var kdfType = KeyStoreKdfChecker.GetKdfType(json);
// Returns "scrypt" or "pbkdf2"

Default Service

var service = new KeyStoreService();

// Encrypt (Scrypt default)
var json = service.EncryptAndGenerateDefaultKeyStoreAsJson(
    "password", privateKeyBytes, address);

// Decrypt (auto-detect)
var key = service.DecryptKeyStoreFromJson("password", json);

For full documentation, see: https://docs.nethereum.com/docs/signing-and-key-management/guide-keystore