Second passphrase feature request
Terminada
gnupg.org at terminada.io
Fri Oct 13 16:20:34 CEST 2023
I am interested by some extra functionality that the Trezor devices
provide. These devices store a key on them and require a passphrase for
unlocking similar to Gnuk. But they also allow you to enter _any_
additional passphrase to generate new keys by combining the second
passphrase entered with the existing stored key.
This second passphrase does not get stored on the device and simply gets
entered each time. If you enter a different second passphrase then you
will produce a different key. Bitcoin, Cardano, and other blockchains
generate their keys from a 12 or 24 word seed phrase. This second
passphrase is like an additional seed word that gets combined with the
existing seed words to produce a new key.
This second passphrase makes the physical device, in a way, un-hackable
because it is not even stored, anywhere. And entering anything will
still produce a valid key. However the process is deterministic in that
entering the same second passphrase will always generate the same key.
The other benefit of this second passphrase is that in effect you can
generate an unlimited number of keys from the base key. Also, entering
the empty passphrase produces the base key.
Would there be a way to add such a feature to Gnuk and gnupg?
Is there some way to generate a new gpg key from an existing one if
given some additional data (second passphrase)?
--
More information about the Gnuk-users
mailing list