diff --git a/pkg/wireguard/keys.go b/pkg/wireguard/keys.go
new file mode 100644
index 0000000..faa8a33
--- /dev/null
+++ b/pkg/wireguard/keys.go
@@ -0,0 +1,30 @@
+package wireguard
+
+import (
+	"encoding/base64"
+)
+
+// BinaryKey is a binary blob
+type BinaryKey []byte
+
+func (k BinaryKey) String() string {
+	return base64.StdEncoding.EncodeToString(k)
+}
+
+// IsZero tells if the key hasn't been set
+func (k BinaryKey) IsZero() bool {
+	return len(k) == 0
+}
+
+// BinaryKeyFromBase64 decodes a base64-based string into
+// a [BinaryKey]
+func BinaryKeyFromBase64(data string) (BinaryKey, error) {
+	b, err := base64.StdEncoding.DecodeString(data)
+	return BinaryKey(b), err
+}
+
+// KeyPair holds a Key pair
+type KeyPair struct {
+	PrivateKey BinaryKey
+	PublicKey  BinaryKey
+}