sneak/hacks
1
0
Fork 1
Code Issues Pull Requests Releases Wiki Activity

keyfunc: deterministic keys, age encryption and child mnemonics from one mnemonic (spec) #1

Closed
clawbot wants to merge 6 commits from clawbot/hacks:bip85ssh into master
pull from: clawbot/hacks:bip85ssh
merge into: :master
Conversation 4 Commits 6 Files Changed 1
+20 -20
1 changed files with 20 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 933fa164c1 - Show all commits
bip85keys/README.md
+20 -20
View File
@@ -23,13 +23,15 @@ The mnemonic is turned into a key like this:
The path is: The path is:
``` ```
m/83696968'/592366788'/<app>'/<n>' m/83696968'/<app>'/<n>'
``` ```
- `83696968` is the fixed BIP-85 purpose. - `83696968` is the fixed BIP-85 purpose.
- `592366788` is the vendor id, `sha256("berlin.sneak") & 0x7fffffff`, the same - `app` is the application number of the key type. There is no vendor id: the
one `agehd` uses. path is meant as a standard any implementation can follow, not something tied
- `app` is the application id of the key type; each type has its own. to one tool. Each key type's number is spelled the way BIP-85 spells its own
RSA application (`828365` is the ASCII codes of `R`, `S`, `A` written out):
SSH is `838372` (`S` `S` `H`), age is `657169` (`A` `G` `E`).
- `n` is the key index: flag `--index` / `-n`, default `0`. - `n` is the key index: flag `--index` / `-n`, default `0`.
## Giving it the mnemonic ## Giving it the mnemonic
@@ -55,17 +57,16 @@ Every command takes `--index` / `-n` and `--mnemonic-command`, and has `--help`.
## SSH keys: `bip85keys ssh` ## SSH keys: `bip85keys ssh`
Only ed25519 keys are produced. The application id is `1822331379`, Only ed25519 keys are produced. The application number is `838372`, so the
`sha256("bip85ssh") & 0x7fffffff`, so the path is path is `m/83696968'/838372'/<n>'`. The 32 bytes from step 4 are the ed25519
`m/83696968'/592366788'/1822331379'/<n>'`. The 32 bytes from step 4 are the seed.
ed25519 seed.
Test vector, mnemonic Test vector, mnemonic
`abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about`: `abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about`:
``` ```
index 0: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1esgfi4OeaywgKh0o5r/8lMOUlUD/N+YoAiC8SNEML index 0: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZOtOczrc/7CQytcuFwt7s4r8KjkZWkwjLZWBaFKD+7
index 1: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB26T7hdDuUF6wfTQ7NpIpyeTgGha4NlhQjaAhap5dqs index 1: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEWY8+/gmHYVC4u0Y0I4FKs+eVUulTPHfk9VtXw1tMF
``` ```
### `bip85keys ssh pub` ### `bip85keys ssh pub`
@@ -97,7 +98,7 @@ It then prints `added` or `already present`. How this `ssh` connection
authenticates is up to the user's normal `ssh` setup (existing keys, agent, authenticates is up to the user's normal `ssh` setup (existing keys, agent,
password). Anything after `--` is passed to `ssh` unchanged. password). Anything after `--` is passed to `ssh` unchanged.
### `bip85keys ssh ssh <host> [ssh arguments...]` ### `bip85keys ssh to <host> [ssh arguments...]`
Derives the key, serves it from an SSH agent that runs inside the tool on a unix Derives the key, serves it from an SSH agent that runs inside the tool on a unix
socket in a new private `0700` temporary directory, then runs the system `ssh` socket in a new private `0700` temporary directory, then runs the system `ssh`
@@ -108,13 +109,12 @@ socket and directory on the way out. The private key is never written to disk.
## age identities: `bip85keys age` (planned) ## age identities: `bip85keys age` (planned)
Not in this PR, which delivers the SSH type first; it is the next type to add. Not in this PR, which delivers the SSH type first; it is the next type to add.
`bip85keys age pub` and `bip85keys age priv` will derive exactly what `bip85keys age pub` and `bip85keys age priv` will use application number
`sneak/secret` derives with its `agehd` package: application id `733482323` `657169`, path `m/83696968'/657169'/<n>'`; the 32 bytes from step 4 are clamped
(`sha256("secret") & 0x7fffffff`), so the path is as X25519 requires and encoded as an `AGE-SECRET-KEY-1...` identity, the same
`m/83696968'/592366788'/733482323'/<n>'`; the 32 bytes from step 4 are clamped steps `sneak/secret` takes in its `agehd` package. `secret` derives at a
as X25519 requires and encoded as an `AGE-SECRET-KEY-1...` identity. An age key vendor-specific path today; for its keys to equal this tool's it moves to this
from this tool for a given mnemonic and index will equal the one `secret` path, which is a change in `secret`, not here.
derives.
## Adding a key type ## Adding a key type
@@ -124,7 +124,7 @@ groups its commands.
## Errors ## Errors
Errors go to standard error and the exit status is 1, except for `ssh ssh`, Errors go to standard error and the exit status is 1, except for `ssh to`,
which passes through `ssh`'s own exit status. which passes through `ssh`'s own exit status.
## Building and running ## Building and running
@@ -140,5 +140,5 @@ Examples:
bip85keys ssh pub -n 3 --mnemonic-command 'secret get foo' bip85keys ssh pub -n 3 --mnemonic-command 'secret get foo'
bip85keys ssh priv -n 3 > ~/.ssh/id_bip85_3 bip85keys ssh priv -n 3 > ~/.ssh/id_bip85_3
bip85keys ssh install -n 3 user@example.com bip85keys ssh install -n 3 user@example.com
bip85keys ssh ssh -n 3 user@example.com uptime bip85keys ssh to -n 3 user@example.com uptime
``` ```