Harden config perms and key derivation

Write generated configs 0600, treat new keys as raw AES-256, keep
PBKDF2 for unprefixed material, and cache derivation at startup.

cmd/teleport/main.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	"crypto/rand"
-	"encoding/hex"
 	"fmt"
 	"os"
 	"os/signal"
@@ -62,7 +60,8 @@ func main() {
 			return
 		}
 		fmt.Printf("Generated encryption key: %s\n", key)
-		fmt.Println("Use this key in your configuration file for both server and client.")
+		fmt.Println("Paste the entire value into encryption_key on both server and client.")
+		fmt.Println("This is a raw 256-bit AES key (no PBKDF2). Unprefixed keys in existing configs still use PBKDF2.")
 		return
 	}
 
@@ -116,21 +115,14 @@ func main() {
 	}
 }
 
-// generateRandomKey generates a cryptographically secure random encryption key
+// generateRandomKey generates a raw 256-bit AES key (raw: + 64 hex chars).
 func generateRandomKey() (string, error) {
-	// Generate 32 random bytes (256 bits) for a strong encryption key
-	bytes := make([]byte, 32)
-	if _, err := rand.Read(bytes); err != nil {
-		return "", fmt.Errorf("failed to generate random key: %v", err)
+	key, err := encryption.GenerateRawKey()
+	if err != nil {
+		return "", err
 	}
-
-	// Convert to hexadecimal string for easy copying
-	key := hex.EncodeToString(bytes)
-
-	// Validate the generated key
 	if err := encryption.ValidateEncryptionKey(key); err != nil {
 		return "", fmt.Errorf("generated key failed validation: %v", err)
 	}
-
 	return key, nil
 }