diff --git a/kasa/aestransport.py b/kasa/aestransport.py
@@ -14,7 +14,7 @@
 from enum import Enum, auto
 from typing import TYPE_CHECKING, Any, Dict, cast
 
-from cryptography.hazmat.primitives import padding, serialization
+from cryptography.hazmat.primitives import hashes, padding, serialization
 from cryptography.hazmat.primitives.asymmetric import padding as asymmetric_padding
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
@@ -108,7 +108,9 @@ def __init__(
         self._key_pair: KeyPair | None = None
         if config.aes_keys:
             aes_keys = config.aes_keys
-            self._key_pair = KeyPair(aes_keys["private"], aes_keys["public"])
+            self._key_pair = KeyPair.create_from_der_keys(
+                aes_keys["private"], aes_keys["public"]
+            )
         self._app_url = URL(f"http://{self._host}:{self._port}/app")
         self._token_url: URL | None = None
 
@@ -277,14 +279,14 @@ async def _generate_key_pair_payload(self) -> AsyncGenerator:
         if not self._key_pair:
             kp = KeyPair.create_key_pair()
             self._config.aes_keys = {
-                "private": kp.get_private_key(),
-                "public": kp.get_public_key(),
+                "private": kp.private_key_der_b64,
+                "public": kp.public_key_der_b64,
             }
             self._key_pair = kp
 
         pub_key = (
             "-----BEGIN PUBLIC KEY-----\n"
-            + self._key_pair.get_public_key()  # type: ignore[union-attr]
+            + self._key_pair.public_key_der_b64  # type: ignore[union-attr]
             + "\n-----END PUBLIC KEY-----\n"
         )
         handshake_params = {"key": pub_key}
@@ -392,18 +394,11 @@ class AesEncyptionSession:
     """Class for an AES encryption session."""
 
     @staticmethod
-    def create_from_keypair(handshake_key: str, keypair):
+    def create_from_keypair(handshake_key: str, keypair: KeyPair):
         """Create the encryption session."""
-        handshake_key_bytes: bytes = base64.b64decode(handshake_key.encode("UTF-8"))
-        private_key_data = base64.b64decode(keypair.get_private_key().encode("UTF-8"))
+        handshake_key_bytes: bytes = base64.b64decode(handshake_key.encode())
 
-        private_key = cast(
-            rsa.RSAPrivateKey,
-            serialization.load_der_private_key(private_key_data, None, None),
-        )
-        key_and_iv = private_key.decrypt(
-            handshake_key_bytes, asymmetric_padding.PKCS1v15()
-        )
+        key_and_iv = keypair.decrypt_handshake_key(handshake_key_bytes)
         if key_and_iv is None:
             raise ValueError("Decryption failed!")
 
@@ -438,30 +433,59 @@ def create_key_pair(key_size: int = 1024):
         """Create a key pair."""
         private_key = rsa.generate_private_key(public_exponent=65537, key_size=key_size)
         public_key = private_key.public_key()
+        return KeyPair(private_key, public_key)
+
+    @staticmethod
+    def create_from_der_keys(private_key_der_b64: str, public_key_der_b64: str):
+        """Create a key pair."""
+        key_bytes = base64.b64decode(private_key_der_b64.encode())
+        private_key = cast(
+            rsa.RSAPrivateKey, serialization.load_der_private_key(key_bytes, None)
+        )
+        key_bytes = base64.b64decode(public_key_der_b64.encode())
+        public_key = cast(
+            rsa.RSAPublicKey, serialization.load_der_public_key(key_bytes, None)
+        )
 
-        private_key_bytes = private_key.private_bytes(
+        return KeyPair(private_key, public_key)
+
+    def __init__(self, private_key: rsa.RSAPrivateKey, public_key: rsa.RSAPublicKey):
+        self.private_key = private_key
+        self.public_key = public_key
+        self.private_key_der_bytes = self.private_key.private_bytes(
             encoding=serialization.Encoding.DER,
             format=serialization.PrivateFormat.PKCS8,
             encryption_algorithm=serialization.NoEncryption(),
         )
-        public_key_bytes = public_key.public_bytes(
+        self.public_key_der_bytes = self.public_key.public_bytes(
             encoding=serialization.Encoding.DER,
             format=serialization.PublicFormat.SubjectPublicKeyInfo,
         )
+        self.private_key_der_b64 = base64.b64encode(self.private_key_der_bytes).decode()
+        self.public_key_der_b64 = base64.b64encode(self.public_key_der_bytes).decode()
 
-        return KeyPair(
-            private_key=base64.b64encode(private_key_bytes).decode("UTF-8"),
-            public_key=base64.b64encode(public_key_bytes).decode("UTF-8"),
+    def get_public_pem(self) -> bytes:
+        """Get public key in PEM encoding."""
+        return self.public_key.public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
         )
 
-    def __init__(self, private_key: str, public_key: str):
-        self.private_key = private_key
-        self.public_key = public_key
-
-    def get_private_key(self) -> str:
-        """Get the private key."""
-        return self.private_key
-
-    def get_public_key(self) -> str:
-        """Get the public key."""
-        return self.public_key
+    def decrypt_handshake_key(self, encrypted_key: bytes) -> bytes:
+        """Decrypt an aes handshake key."""
+        decrypted = self.private_key.decrypt(
+            encrypted_key, asymmetric_padding.PKCS1v15()
+        )
+        return decrypted
+
+    def decrypt_discovery_key(self, encrypted_key: bytes) -> bytes:
+        """Decrypt an aes discovery key."""
+        decrypted = self.private_key.decrypt(
+            encrypted_key,
+            asymmetric_padding.OAEP(
+                mgf=asymmetric_padding.MGF1(algorithm=hashes.SHA1()),  # noqa: S303
+                algorithm=hashes.SHA1(),  # noqa: S303
+                label=None,
+            ),
+        )
+        return decrypted
diff --git a/kasa/cli/discover.py b/kasa/cli/discover.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import asyncio
+from pprint import pformat as pf
 
 import asyncclick as click
 from pydantic.v1 import ValidationError
@@ -28,6 +29,7 @@ async def discover(ctx):
     password = ctx.parent.params["password"]
     discovery_timeout = ctx.parent.params["discovery_timeout"]
     timeout = ctx.parent.params["timeout"]
+    host = ctx.parent.params["host"]
     port = ctx.parent.params["port"]
 
     credentials = Credentials(username, password) if username and password else None
@@ -49,8 +51,6 @@ async def print_unsupported(unsupported_exception: UnsupportedDeviceError):
                 echo(f"\t{unsupported_exception}")
                 echo()
 
-    echo(f"Discovering devices on {target} for {discovery_timeout} seconds")
-
     from .device import state
 
     async def print_discovered(dev: Device):
@@ -68,6 +68,18 @@ async def print_discovered(dev: Device):
                 discovered[dev.host] = dev.internal_state
             echo()
 
+    if host:
+        echo(f"Discovering device {host} for {discovery_timeout} seconds")
+        return await Discover.discover_single(
+            host,
+            port=port,
+            credentials=credentials,
+            timeout=timeout,
+            discovery_timeout=discovery_timeout,
+            on_unsupported=print_unsupported,
+        )
+
+    echo(f"Discovering devices on {target} for {discovery_timeout} seconds")
     discovered_devices = await Discover.discover(
         target=target,
         discovery_timeout=discovery_timeout,
@@ -113,21 +125,31 @@ def _echo_discovery_info(discovery_info):
         _echo_dictionary(discovery_info)
         return
 
+    def _conditional_echo(label, value):
+        if value:
+            ws = " " * (19 - len(label))
+            echo(f"\t{label}:{ws}{value}")
+
     echo("\t[bold]== Discovery Result ==[/bold]")
-    echo(f"\tDevice Type:        {dr.device_type}")
-    echo(f"\tDevice Model:       {dr.device_model}")
-    echo(f"\tIP:                 {dr.ip}")
-    echo(f"\tMAC:                {dr.mac}")
-    echo(f"\tDevice Id (hash):   {dr.device_id}")
-    echo(f"\tOwner (hash):       {dr.owner}")
-    echo(f"\tHW Ver:             {dr.hw_ver}")
-    echo(f"\tSupports IOT Cloud: {dr.is_support_iot_cloud}")
-    echo(f"\tOBD Src:            {dr.obd_src}")
-    echo(f"\tFactory Default:    {dr.factory_default}")
-    echo(f"\tEncrypt Type:       {dr.mgt_encrypt_schm.encrypt_type}")
-    echo(f"\tSupports HTTPS:     {dr.mgt_encrypt_schm.is_support_https}")
-    echo(f"\tHTTP Port:          {dr.mgt_encrypt_schm.http_port}")
-    echo(f"\tLV (Login Level):   {dr.mgt_encrypt_schm.lv}")
+    _conditional_echo("Device Type", dr.device_type)
+    _conditional_echo("Device Model", dr.device_model)
+    _conditional_echo("Device Name", dr.device_name)
+    _conditional_echo("IP", dr.ip)
+    _conditional_echo("MAC", dr.mac)
+    _conditional_echo("Device Id (hash)", dr.device_id)
+    _conditional_echo("Owner (hash)", dr.owner)
+    _conditional_echo("FW Ver", dr.firmware_version)
+    _conditional_echo("HW Ver", dr.hw_ver)
+    _conditional_echo("HW Ver", dr.hardware_version)
+    _conditional_echo("Supports IOT Cloud", dr.is_support_iot_cloud)
+    _conditional_echo("OBD Src", dr.owner)
+    _conditional_echo("Factory Default", dr.factory_default)
+    _conditional_echo("Encrypt Type", dr.mgt_encrypt_schm.encrypt_type)
+    _conditional_echo("Encrypt Type", dr.encrypt_type)
+    _conditional_echo("Supports HTTPS", dr.mgt_encrypt_schm.is_support_https)
+    _conditional_echo("HTTP Port", dr.mgt_encrypt_schm.http_port)
+    _conditional_echo("Encrypt info", pf(dr.encrypt_info) if dr.encrypt_info else None)
+    _conditional_echo("Decrypted", pf(dr.decrypted_data) if dr.decrypted_data else None)
 
 
 async def find_host_from_alias(alias, target="255.255.255.255", timeout=1, attempts=3):

diff --git a/kasa/cli/main.py b/kasa/cli/main.py
@@ -158,6 +158,7 @@ def _legacy_type_to_class(_type):
     type=click.Choice(ENCRYPT_TYPES, case_sensitive=False),
 )
 @click.option(
+    "-df",
     "--device-family",
     envvar="KASA_DEVICE_FAMILY",
     default="SMART.TAPOPLUG",
@@ -182,7 +183,7 @@ def _legacy_type_to_class(_type):
 @click.option(
     "--discovery-timeout",
     envvar="KASA_DISCOVERY_TIMEOUT",
-    default=5,
+    default=10,
     required=False,
     show_default=True,
     help="Timeout for discovery.",
@@ -326,15 +327,11 @@ async def cli(
         dev = await Device.connect(config=config)
         device_updated = True
     else:
-        from kasa.discover import Discover
+        from .discover import discover
 
-        dev = await Discover.discover_single(
-            host,
-            port=port,
-            credentials=credentials,
-            timeout=timeout,
-            discovery_timeout=discovery_timeout,
-        )
+        dev = await ctx.invoke(discover)
+        if not dev:
+            error(f"Unable to create device for {host}")
 
     # Skip update on specific commands, or if device factory,
     # that performs an update was used for the device.