Second passphrase feature request

Terminada gnupg.org at terminada.io
Fri Oct 13 16:20:34 CEST 2023


I am interested by some extra functionality that the Trezor devices 
provide.  These devices store a key on them and require a passphrase for 
unlocking similar to Gnuk.  But they also allow you to enter _any_ 
additional passphrase to generate new keys by combining the second 
passphrase entered with the existing stored key.

This second passphrase does not get stored on the device and simply gets 
entered each time.  If you enter a different second passphrase then you 
will produce a different key.  Bitcoin, Cardano, and other blockchains 
generate their keys from a 12 or 24 word seed phrase.  This second 
passphrase is like an additional seed word that gets combined with the 
existing seed words to produce a new key.

This second passphrase makes the physical device, in a way, un-hackable 
because it is not even stored, anywhere.  And entering anything will 
still produce a valid key.  However the process is deterministic in that 
entering the same second passphrase will always generate the same key.

The other benefit of this second passphrase is that in effect you can 
generate an unlimited number of keys from the base key.  Also, entering 
the empty passphrase produces the base key.

Would there be a way to add such a feature to Gnuk and gnupg?

Is there some way to generate a new gpg key from an existing one if 
given some additional data (second passphrase)?
--



More information about the Gnuk-users mailing list