derivepassphrase.git

1) # derivepassphrase
2) 
3) [![PyPI - Version](https://img.shields.io/pypi/v/derivepassphrase.svg)](https://pypi.org/project/derivepassphrase)
4) [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/derivepassphrase.svg)](https://pypi.org/project/derivepassphrase)
5) 

6) An almost faithful Python reimplementation of [James Coglan's `vault`][VAULT], a deterministic password manager/generator.
7) 
8) Using a master passphrase or a master SSH key, derive a passphrase for a given named service, subject to length, character and character repetition constraints.
9) The derivation is cryptographically strong, meaning that even if a single passphrase is compromised, guessing the master passphrase or a different service's passphrase is computationally infeasible.
10) The derivation is also deterministic, given the same inputs, thus the resulting passphrase need not be stored explicitly.
11) The service name and constraints themselves also need not be kept secret; the latter are usually stored in a world-readable file.

12) 

13) [VAULT]: https://getvau.lt

14) 

15) -----

16) 
17) ## Installation
18) 

19) ### With `pip`
20) 

21) (If not inside a [virtual environment][VENV], use `pip install --user` instead of plain `pip install`.)
22) 

23) ```` shell-session

24) $ pip install derivepassphrase

25) ````

26) 

27) To use the `export` subcommand, install the `export` extra:
28) 
29) ```` shell-session
30) $ pip install "derivepassphrase[export]"
31) ````
32) 
33) [VENV]: https://docs.python.org/3/library/venv.html
34) 

35) ### Manually
36) 

37) `derivepassphrase` is a pure Python package, and may be easily installed manually by placing the respective files and the package's dependencies into Python's import path.
38) `derivepassphrase` requires Python 3.10 or higher as well as the [typing-extensions package][TYPING_EXTENSIONS] for its core functionality and programmatic interface, and [`click`][CLICK] 8.1 or higher for its command-line interface.

39) Using the `export vault` subcommand additionally requires the [cryptography package][CRYPTOGRAPHY], version 38.0 or newer.

40) 

41) [TYPING_EXTENSIONS]: https://pypi.org/project/typing-extensions/

42) [CLICK]: https://click.palletsprojects.com/

43) [CRYPTOGRAPHY]: https://github.com/pyca/cryptography

44) 
45) ## Quick Usage
46) 

47) `derivepassphrase` is designed to principally support multiple passphrase derivation schemes, but currently only the "[vault][VAULT]" scheme is implemented.
48) 
49) Using the passphrase `This passphrase is for demonstration purposes only.` when prompted:
50) 

51) ```` shell-session

52) $ derivepassphrase vault -p --length 30 --upper 3 --lower 1 --number 2 --space 0 --symbol 0 my-email-account

53) Passphrase: 

54) JKeet7GeBpxysOgdCEJo6UzmP8A0Ih

55) ````

56) 
57) Some time later…
58) 

59) ```` shell-session

60) $ derivepassphrase vault -p --length 30 --upper 3 --lower 1 --number 2 --space 0 --symbol 0 my-email-account

61) Passphrase: 

62) JKeet7GeBpxysOgdCEJo6UzmP8A0Ih

63) ````

64) 

65) ### Storing settings
66) 
67) `derivepassphrase` can store the length and character constraint settings in its configuration file so that you do not have to re-enter them each time.
68) 
69) ```` shell-session
70) $ derivepassphrase vault --config --length 30 --upper 3 --lower 1 --number 2 --space 0 --symbol 0 my-email-account
71) $ derivepassphrase vault -p my-email-account
72) Passphrase: 
73) JKeet7GeBpxysOgdCEJo6UzmP8A0Ih
74) ````
75) 
76) ### SSH agent support
77) 
78) On UNIX-like systems with OpenSSH or PuTTY installed, you can use an Ed25519, Ed448 or RSA key from the agent instead of a master passphrase.
79) ([On Windows there are problems establishing communication channels with the agent.][#13])
80) 
81) ```` shell-session
82) $ derivepassphrase vault -k my-email-account
83) Suitable SSH keys:
84) [1] ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQ... test key
85) [2] ssh-ed448 AAAACXNzaC1lZDQ0OAAAADni9nLTT1... test key
86) [3] ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIF4gW... test key
87) Your selection? (1-3, leave empty to abort): 1
88) oXDGCvMhLWPQyCzYtaobOq2Wh9olYj
89) ````
90) 
91) `derivepassphrase` can store the SSH key selection in its configuration file so you do not have to re-select it each time.
92) This choice can be made either specifically for the service (in this case, `my-email-account`), or globally.
93) 
94) ```` shell-session
95) $ derivepassphrase vault --config -k  # global setting
96) Suitable SSH keys:
97) [1] ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQ... test key
98) [2] ssh-ed448 AAAACXNzaC1lZDQ0OAAAADni9nLTT1... test key
99) [3] ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIF4gW... test key
100) Your selection? (1-3, leave empty to abort): 1
101) $ derivepassphrase vault my-email-account
102) oXDGCvMhLWPQyCzYtaobOq2Wh9olYj
103) ````
104) 
105) [#13]: https://github.com/the-13th-letter/derivepassphrase/issues/13 "Issue 13: Support PuTTY/Pageant (and maybe OpenSSH/ssh-agent) on Windows"

106)