0.x/tutorials/basic-setup-ssh-key/index.html (1bff169) - derivepassphrase.git

index.html

<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
        <meta name="description" content="An almost faithful Python reimplementation of James Coglan's vault.">
      
      
        <meta name="author" content="Marco Ricci">
      
      
        <link rel="canonical" href="https://the13thletter.info/derivepassphrase/0.x/tutorials/basic-setup-ssh-key/">
      
      
        <link rel="prev" href="../basic-setup-passphrase/">
      
      
        <link rel="next" href="../../how-tos/">
      
      
        
      
      
      <link rel="icon" href="../../assets/images/favicon.png">
      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.6">
    
    
      
        <title>Using a master SSH key with derivepassphrase vault on existing accounts - derivepassphrase</title>
      
    
    
      <link rel="stylesheet" href="../../assets/stylesheets/main.484c7ddc.min.css">

</a>
    </li>

<li class="md-tabs__item md-tabs__item--active">
        <a href="../" class="md-tabs__link">
          
  
  
    
  
  Tutorials & Examples

</a>
      </li>

<li class="md-tabs__item">
        <a href="../../how-tos/" class="md-tabs__link">
          
  
  
    
  
  How-Tos

</a>
      </li>

<li class="md-tabs__item">
        <a href="../../reference/" class="md-tabs__link">
          
  
  
    
  
  Reference

</a>
      </li>

<li class="md-tabs__item">
        <a href="../../explanation/" class="md-tabs__link">
          
  
  
    
  
  Design & Background

</a>
      </li>

<li class="md-tabs__item">
        <a href="../../changelog/" class="md-tabs__link">
          
  
  
    
  
  Changelog

</a>
      </li>

<li class="md-tabs__item">
        <a href="../../wishlist/" class="md-tabs__link">
          
  
  
    
  
  Wishlist

</a>
      </li>

</ul>
  </div>
</nav>
          
        
      
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">

</a>
    derivepassphrase
  </label>
  
    <div class="md-nav__source">
      <a href="https://git.schokokeks.org/derivepassphrase.git" title="Go to repository" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"/></svg>
  </div>
  <div class="md-source__repository">
    the-13th-letter/derivepassphrase
  </div>
</a>
    </div>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
      
  
  
  
  
    <li class="md-nav__item">
      <a href="../.." class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Overview

</span>

</a>
    </li>

<li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2" checked>
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../" class="md-nav__link ">
              
  
  
  <span class="md-ellipsis">
    
  
    Tutorials & Examples

</span>

</a>
            
              
              <label class="md-nav__link " for="__nav_2" id="__nav_2_label" tabindex="">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_2">
            <span class="md-nav__icon md-icon"></span>
            
  
    Tutorials & Examples

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../basic-setup-passphrase/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Setting up derivepassphrase vault for three accounts, with a master passphrase

</span>

</a>
    </li>

<li class="md-nav__item md-nav__item--active">
      
      <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
      
      
        
      
      
        <label class="md-nav__link md-nav__link--active" for="__toc">
          
  
  
  <span class="md-ellipsis">
    
  
    Using a master SSH key with derivepassphrase vault on existing accounts

</span>

<span class="md-nav__icon md-icon"></span>
        </label>
      
      <a href="./" class="md-nav__link md-nav__link--active">
        
  
  
  <span class="md-ellipsis">
    
  
    Using a master SSH key with derivepassphrase vault on existing accounts

</span>

</a>

<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
  
    
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#the-scenario" class="md-nav__link">
    <span class="md-ellipsis">
      
        The scenario
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#installing-derivepassphrase-with-ssh-key-support" class="md-nav__link">
    <span class="md-ellipsis">
      
        Installing derivepassphrase with SSH key support
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#setting-up-an-ssh-agent-and-ssh-key-generator" class="md-nav__link">
    <span class="md-ellipsis">
      
        Setting up an SSH agent and SSH key generator
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#generating-a-master-ssh-key-and-loading-it-into-the-agent" class="md-nav__link">
    <span class="md-ellipsis">
      
        Generating a master SSH key, and loading it into the agent
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#reconfiguring-the-accounts" class="md-nav__link">
    <span class="md-ellipsis">
      
        Reconfiguring the accounts
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#using-the-master-ssh-key-by-default" class="md-nav__link">
    <span class="md-ellipsis">
      
        Using the master SSH key by default
      
    </span>
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#summary" class="md-nav__link">
    <span class="md-ellipsis">
      
        Summary
      
    </span>
  </a>
  
</li>
      
    </ul>
  
</nav>
      
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../../how-tos/" class="md-nav__link ">
              
  
  
  <span class="md-ellipsis">
    
  
    How-Tos

</span>

</a>
            
              
              <label class="md-nav__link " for="__nav_3" id="__nav_3_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_3">
            <span class="md-nav__icon md-icon"></span>
            
  
    How-Tos

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../how-tos/ssh-key/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    How to set up derivepassphrase vault with an SSH key

</span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../../reference/" class="md-nav__link ">
              
  
  
  <span class="md-ellipsis">
    
  
    Reference

</span>

</a>
            
              
              <label class="md-nav__link " for="__nav_4" id="__nav_4_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4">
            <span class="md-nav__icon md-icon"></span>
            
  
    Reference

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
              
                
  
  
  
  
    
    
      
        
      
        
      
        
      
        
      
    
    
    
      
      
        
      
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_2" >
        
          
          <label class="md-nav__link" for="__nav_4_2" id="__nav_4_2_label" tabindex="0">
            
  
  
  <span class="md-ellipsis">
    
  
    Man pages

</span>

<span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4_2">
            <span class="md-nav__icon md-icon"></span>
            
  
    Man pages

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../reference/derivepassphrase.1/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    derivepassphrase(1)

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase-vault.1/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    derivepassphrase-vault(1)

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase-export.1/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    derivepassphrase-export(1)

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase-export-vault.1/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    derivepassphrase-export-vault(1)

</span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_3" >
        
          
          <label class="md-nav__link" for="__nav_4_3" id="__nav_4_3_label" tabindex="0">
            
  
  
  <span class="md-ellipsis">
    
  
    API docs: Module derivepassphrase

</span>

<span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_3_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4_3">
            <span class="md-nav__icon md-icon"></span>
            
  
    API docs: Module derivepassphrase

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../reference/derivepassphrase.cli/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Submodule cli

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.exporter/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Subpackage exporter

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.sequin/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Submodule sequin

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.ssh_agent/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Submodule ssh_agent

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase._types/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Submodule _types

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../reference/derivepassphrase.vault/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Submodule vault

</span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_4" >
        
          
          <label class="md-nav__link" for="__nav_4_4" id="__nav_4_4_label" tabindex="0">
            
  
  
  <span class="md-ellipsis">
    
  
    Technical prerequisites

</span>

<span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4_4">
            <span class="md-nav__icon md-icon"></span>
            
  
    Technical prerequisites

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../reference/prerequisites-ssh-key/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Using derivepassphrase vault with an SSH key

</span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../../explanation/" class="md-nav__link ">
              
  
  
  <span class="md-ellipsis">
    
  
    Design & Background

</span>

</a>
            
              
              <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0">
                <span class="md-nav__icon md-icon"></span>
              </label>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_5">
            <span class="md-nav__icon md-icon"></span>
            
  
    Design & Background

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../explanation/faq-altered-versions/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    "altered versions" license requirement

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../explanation/faq-vault-interchangable-passphrases/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    "interchangable passphrases" in vault

</span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" >
        
          
          <label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
            
  
  
  <span class="md-ellipsis">
    
  
    Changelog

</span>

<span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_6">
            <span class="md-nav__icon md-icon"></span>
            
  
    Changelog

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../changelog/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Changelog

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../upgrade-notes/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Upgrade notes

</span>

</a>
    </li>

<li class="md-nav__item">
      <a href="../../pycompatibility/" class="md-nav__link">
        
  
  
  <span class="md-ellipsis">
    
  
    Python compatibility

</span>

</a>
    </li>

</ul>
        </nav>
      
    </li>

<li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" >
        
          
          <div class="md-nav__link md-nav__container">
            <a href="../../wishlist/" class="md-nav__link ">
              
  
  
  <span class="md-ellipsis">
    
  
    Wishlist

</span>

</a>
            
          </div>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_7">
            <span class="md-nav__icon md-icon"></span>
            
  
    Wishlist

</label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
            
          </ul>
        </nav>
      
    </li>

</ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              
              <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">

<h1 id="using-a-master-ssh-key-with-derivepassphrase-vault-on-existing-accounts">Using a master SSH key with <code>derivepassphrase vault</code> on existing accounts<a class="headerlink" href="#using-a-master-ssh-key-with-derivepassphrase-vault-on-existing-accounts" title="Permanent link">&para;</a></h1>
<div class="admonition abstract">
<p class="admonition-title">See also</p>
<p>→ <a href="../basic-setup-passphrase/">Tutorial: Setting up <code>derivepassphrase vault</code> for three accounts, with a master passphrase</a></p>
<p>→ Tradeoffs between a master passphrase and a master SSH key (TODO)</p>
</div>
<h2 id="the-scenario">The scenario<a class="headerlink" href="#the-scenario" title="Permanent link">&para;</a></h2>
<p>This tutorial builds upon the previous <a href="../basic-setup-passphrase/">tutorial for setting up <code>derivepassphrase vault</code> for three accounts, with a master passphrase</a>.
We have a working <code>derivepassphrase</code> installation, and a <code>derivepassphrase vault</code> configuration for three services <code>email</code>, <code>bank</code> and <code>work</code>, using a master passphrase.</p>
<h2 id="installing-derivepassphrase-with-ssh-key-support">Installing <code>derivepassphrase</code> with SSH key support<a class="headerlink" href="#installing-derivepassphrase-with-ssh-key-support" title="Permanent link">&para;</a></h2>
<details class="note">
<summary>Note: Shell Notation</summary>
<p><code>derivepassphrase</code> is a command-line application: it runs in the system shell, such as <code>/bin/sh</code> on UNIX and Powershell on Windows.</p>
<p>In the following shell session transcripts, <code>$</code> and &lsquo;&gt;&rsquo; denote the <b>prompt</b> from the system shell for user input.
Type in <em>the remainder</em> of line, but not the prompt itself.
Other lines are <em>output lines</em>, which should appear on your shell.</p>
<p>For Windows-specific commands, we use the <code>PS&gt;</code> prompt; otherwise, we use UNIX-style <code>$</code> and <code>&gt;</code> prompts.</p>
</details>
<p><a href="../basic-setup-passphrase/#installing-derivepassphrase">You have already installed <code>derivepassphrase</code>.</a>
Once again, check that the installation was successful.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>devirepassphrase<span class="w"> </span>vault<span class="w"> </span>--version
<span class="go">derivepassphrase 0.5</span>
<span class="go">Using cryptography 44.0.0</span>
<span class="go">Using click 8.1.8</span>

<span class="go">Supported features: master SSH key.</span>
</code></pre></div>
<p>(…or similar output.)
Furthermore, verify that &ldquo;master SSH key&rdquo; is among the listed supported features.<sup id="fnref:no-support"><a class="footnote-ref" href="#fn:no-support">1</a></sup>
Without support for SSH keys, this tutorial cannot be completed.</p>
<h2 id="setting-up-an-ssh-agent-and-ssh-key-generator">Setting up an SSH agent and SSH key generator<a class="headerlink" href="#setting-up-an-ssh-agent-and-ssh-key-generator" title="Permanent link">&para;</a></h2>
<p><code>derivepassphrase</code> cannot generate SSH keys or do SSH key operations itself; instead, it relies on widespread and well-tested third-party software such as OpenSSH or PuTTY for this purpose.
We need to install such software as well.</p>
<div class="admonition info">
<p class="admonition-title">Setup steps</p>
<div class="tabbed-set tabbed-alternate" data-tabs="1:2"><input checked="checked" id="__tabbed_1_1" name="__tabbed_1" type="radio" /><input id="__tabbed_1_2" name="__tabbed_1" type="radio" /><div class="tabbed-labels"><label for="__tabbed_1_1">UNIX (and Cygwin/MSYS, WSL, and Git for Windows)</label><label for="__tabbed_1_2">Windows</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<p>You likely already have OpenSSH installed, or can easily install them via your package manager or via <a href="https://www.openssh.org/">the official OpenSSH distribution</a>.
We only need access to the <code>ssh-agent</code>, <code>ssh-add</code> and <code>ssh-keygen</code> client tools; in particular, we do not need the OpenSSH server.</p>
<div class="highlight"><span class="filename">Getting the version number of the installed OpenSSH client tools</span><pre><span></span><code><span class="gp">$ </span>ssh<span class="w"> </span>-V
<span class="go">OpenSSH_10.2p1, OpenSSL 3.5.4 30 Sep 2025</span>
</code></pre></div>
<p>Start an SSH agent if none is running yet.
(Some desktop environments automatically launch an agent on startup.)
We can check this via <code>ssh-add -l</code>.</p>
<div class="tabbed-set tabbed-alternate" data-tabs="2:3"><input checked="checked" id="__tabbed_2_1" name="__tabbed_2" type="radio" /><input id="__tabbed_2_2" name="__tabbed_2" type="radio" /><input id="__tabbed_2_3" name="__tabbed_2" type="radio" /><div class="tabbed-labels"><label for="__tabbed_2_1">&quot;Could not open a connection…&quot;</label><label for="__tabbed_2_2">&quot;The agent has no identities.&quot;</label><label for="__tabbed_2_3">random gibberish</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>ssh-add<span class="w"> </span>-l
<span class="go">Could not open a connection to your authentication agent.</span>
</code></pre></div>
<p>The agent is not running.
So start an agent manually:</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span><span class="nb">eval</span><span class="w"> </span><span class="s2">&quot;</span><span class="k">$(</span>ssh-agent<span class="w"> </span>-s<span class="k">)</span><span class="s2">&quot;</span>
</code></pre></div>
<p>and arrange for it to be shut down upon exiting this shell session:</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span><span class="nb">trap</span><span class="w"> </span><span class="s2">&quot;kill </span><span class="nv">$SSH_AGENT_PID</span><span class="s2">&quot;</span><span class="w"> </span><span class="m">0</span>
</code></pre></div>
</div>
<div class="tabbed-block">
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>ssh-add<span class="w"> </span>-l
<span class="go">The agent has no identities.</span>
</code></pre></div>
<p>The agent is already running.</p>
</div>
<div class="tabbed-block">
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>ssh-add<span class="w"> </span>-l
<span class="go">256 SHA256:0h+WAokssfhzfzVyuMLJlIcWyCtk5WiXI8BHyhXYxC0  (ED25519)</span>
<span class="go">3072 SHA256:1OHE0HrVlaSzJn2aQXQIKRu0tfO1CEMefy95K2Bt0xA  (RSA)</span>
</code></pre></div>
<p>(… or similar output, perhaps with text.)</p>
<p>The agent is running, and already contains some keys.</p>
</div>
</div>
</div>
</div>
<div class="tabbed-block">
<div style="float: right;">
<p><figure markdown>
<img alt="A CRT monitor wearing a spy hat." loading="lazy" src="../pageant.svg" width="96" />
<figcaption>
<a href="https://www.chiark.greenend.org.uk/~sgtatham/quasiblog/putty-icons/">The <code>pageant</code> icon</a>
</figcaption>
</figure></p>
</div>
<p>Install PuTTY e.g. from <a href="https://putty.software/">the official PuTTY distribution</a> website, or from the Microsoft Store (if supported).
We only need access to the <code>pageant</code> and <code>puttygen</code> tools.</p>
<p>Start <code>pageant</code> if it isn&rsquo;t running yet.
An icon of a CRT computer monitor wearing a black hat should appear in the task bar.</p>
</div>
</div>
</div>
</div>
<h2 id="generating-a-master-ssh-key-and-loading-it-into-the-agent">Generating a master SSH key, and loading it into the agent<a class="headerlink" href="#generating-a-master-ssh-key-and-loading-it-into-the-agent" title="Permanent link">&para;</a></h2>
<div class="admonition abstract">
<p class="admonition-title">Further reading</p>
<p>→ <a href="../../reference/prerequisites-ssh-key/#ssh-key">Prerequisites for the SSH key, for use with <code>derivepassphrase
vault</code></a></p>
</div>
<details class="warning">
<summary>Operational risk: reusing &quot;login&quot; SSH keys for passphrase derivation</summary>
<p>SSH keys are typically used as access tokens for logging in on a remote system.
You are <strong>strongly discouraged</strong> from reusing such an existing &ldquo;login&rdquo; key for passphrase derivation.
A master SSH key is a <strong>long-lived secret</strong>, and should <strong>never need to be rotated<sup id="fnref:key-rotation-def"><a class="footnote-ref" href="#fn:key-rotation-def">2</a></sup>, unless compromised or lost</strong>.
Rotating a master SSH key means <strong>forcibly changing all passphrases that are derived from this key</strong>.
By contrast, a login SSH key is an access token, and may be rotated for other policy-related reasons (e.g. algorithm or key size upgrades, key consolidation, …).</p>
<p>Beyond key rotation, reusing an existing login key also means that, when compromised, <strong>all your logins <em>and</em> all your passphrases will be affected</strong>.</p>
</details>
<p>We generate a new Ed25519-type key for use with <code>derivepassphrase</code>.</p>
<div class="admonition info">
<p class="admonition-title">Generating a key (operating system-specific)</p>
<div class="tabbed-set tabbed-alternate" data-tabs="3:2"><input checked="checked" id="__tabbed_3_1" name="__tabbed_3" type="radio" /><input id="__tabbed_3_2" name="__tabbed_3" type="radio" /><div class="tabbed-labels"><label for="__tabbed_3_1">UNIX (and Cygwin/MSYS, WSL, and Git for Windows)</label><label for="__tabbed_3_2">Windows</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<p>We store the key as <code>my-vault-ed25519-key</code> in <code>~/.ssh</code>, using the comment &ldquo;vault key&rdquo;.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>ssh-keygen<span class="w"> </span>-t<span class="w"> </span>ed25519<span class="w"> </span>-f<span class="w"> </span>~/.ssh/my-vault-ed25519-key<span class="w"> </span>-C<span class="w"> </span><span class="s2">&quot;vault key&quot;</span>
<span class="go">Generating public/private ed25519 key pair.</span>
<span class="go">Enter passphrase for &quot;.../.ssh/my-vault-ed25519-key&quot; (empty for no passphrase): </span>
<span class="go">Enter same passphrase again: </span>
<span class="go">Your identification has been saved in .../.ssh/my-vault-ed25519-key</span>
<span class="go">Your public key has been saved in .../.ssh/my-vault-ed25519-key.pub</span>
<span class="go">The key fingerprint is:</span>
<span class="go">SHA256:0h+WAokssfhzfzVyuMLJlIcWyCtk5WiXI8BHyhXYxC0 vault key</span>
<span class="go">The key&#39;s randomart image is:</span>
<span class="go">+--[ED25519 256]--+</span>
<span class="go">|o B=+            |</span>
<span class="go">|.=oE = .         |</span>
<span class="go">|.oX @ +          |</span>
<span class="go">| = + o * . .     |</span>
<span class="go">|  + o * S B      |</span>
<span class="go">|   + * + O o     |</span>
<span class="go">|      * o .      |</span>
<span class="go">|       o         |</span>
<span class="go">|                 |</span>
<span class="go">+----[SHA256]-----+</span>
</code></pre></div>
</div>
<div class="tabbed-block">
<p>Start <code>puttygen</code>.
Under &ldquo;Parameters&rdquo;, as &ldquo;Type of key to generate&rdquo;, select <strong>EdDSA</strong>, and as &ldquo;Curve to use for generating this key&rdquo;, select <strong>Ed25519 (255 bits)</strong>.
Then, under &ldquo;Actions&rdquo;, select &ldquo;Generate&rdquo;, and follow the on-screen instructions.</p>
<p><figure markdown>
<img alt="puttygen's key generation parameters" loading="lazy" src="../puttygen-key-parameters.png" />
</figure></p>
<p>Set the comment to &ldquo;vault key&rdquo;, and set a strong key passphrase (<em>recommended</em>).
Finally, select &ldquo;Save private key&rdquo;, and store the key as <code>my-vault-ed25519-key.ppk</code> in <code>My Documents</code>.
We can now close <code>puttygen</code>.</p>
<p><figure markdown>
<img alt="puttygen after key generation" loading="lazy" src="../puttygen-key-generation.png" />
</figure></p>
</div>
</div>
</div>
</div>
<section id="sample-key">
<div class="admonition note">
<p class="admonition-title">Note: reproducibility</p>
<p><strong>SSH key generation is non-reproducible</strong>: your key will naturally differ from ours, as will the key fingerprint, the randomart image (if any), and &ndash; in general, for sufficiently loose constraints &ndash; the passphrases derived from this master SSH key.
This is <em>intentional</em> &ndash; you wouldn&rsquo;t want others to be able to access all of your passphrases just because they installed the same software as you and have access to, or can guess, your configuration.</p>
<p>This also means that you will get <strong>different derived passphrases from us</strong> unless you use <a href="../../test_key_ed25519">exactly the same master SSH key as we are using (OpenSSH format, no key passphrase)</a> <a href="../../test_key_ed25519.ppk">(PuTTY format, no key passphrase)</a>.<sup id="fnref:test-key-comment"><a class="footnote-ref" href="#fn:test-key-comment">3</a></sup></p>
</div>
</section>
<p>We then need to load the key into the agent, so that <code>derivepassphrase</code> can interact with it.
The key will persist as long as the agent is running, and will need to be re-added the next time the agent is started.</p>
<div class="admonition info">
<p class="admonition-title">Loading the key into the agent (operating system-specific)</p>
<div class="tabbed-set tabbed-alternate" data-tabs="4:2"><input checked="checked" id="__tabbed_4_1" name="__tabbed_4" type="radio" /><input id="__tabbed_4_2" name="__tabbed_4" type="radio" /><div class="tabbed-labels"><label for="__tabbed_4_1">UNIX (and Cygwin/MSYS, WSL, and Git for Windows)</label><label for="__tabbed_4_2">Windows</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<p>We instruct the agent to pop up a confirmation prompt each time the key is used, as a safety precaution.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>ssh-add<span class="w"> </span>-c<span class="w"> </span>~/.ssh/my-vault-ed25519-key
<span class="go">Enter passphrase for .../.ssh/my-vault-ed25519-key (will confirm each use):</span>
<span class="go">Identity added: .../.ssh/my-vault-ed25519-key (vault key)</span>
<span class="go">The user must confirm each use of the key</span>
</code></pre></div>
<p>Now each call to <code>derivepassphrase vault</code> using this SSH key (only when deriving a passphrase) will ellicit a confirmation prompt by the agent.
Conversely, any confirmation prompt for this key <em>at other times</em> originates from a <em>different</em> program, and is therefore suspicious and should not be granted.
(See operational risks above.)</p>
</div>
<div class="tabbed-block">
<p>Open <code>pageant</code>&rsquo;s context menu (via right-click), then select &ldquo;Add key (encrypted)&rdquo;.
In the file chooser dialog that opens, select <code>my-vault-ed25519-key.ppk</code> in <code>My Documents</code>.
The key should now be loaded.</p>
<p><figure markdown>
<img alt="pageant context menu" loading="lazy" src="../pageant-context-menu.png" />
</figure></p>
<p>To verify this, select &ldquo;View keys&rdquo; from <code>pageant</code>&rsquo;s context menu to bring up the list of keys <code>pageant</code> is currently holding in memory.
The Ed25519 key we just created should be listed there, along with the &ldquo;vault key&rdquo; comment.</p>
<p>Upon first use of the key, <code>pageant</code> will issue a passphrase prompt for the key passphrase.
The key will be unlocked, and thus usable without prompts, until it is re-encrypted in the &ldquo;View keys&rdquo; menu.
Re-encrypt/lock the key whenever you are done using it with <code>derivepassphrase</code> to minimize the time window during which the key is accessible to other programs.
(See operational risks above.)</p>
</div>
</div>
</div>
</div>
<h2 id="reconfiguring-the-accounts">Reconfiguring the accounts<a class="headerlink" href="#reconfiguring-the-accounts" title="Permanent link">&para;</a></h2>
<details class="note">
<summary>Reminder: interactive input</summary>
<p>In code listings, sections enclosed in <code>[[...]]</code> signify input to the program, for you to type or paste in.</p>
<p>Also, it is normal for passphrase prompts to not &ldquo;echo&rdquo; the text you type in.</p>
</details>
<p>In the previous tutorial that set up the three accounts, <a href="../basic-setup-passphrase/#summary">we stored the settings for each account to <code>derivepassphrase vault</code>&rsquo;s configuration</a>, meaning that we only have to enter the master passphrase to access the account passphrases.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--export<span class="w"> </span>-<span class="w">  </span><span class="c1"># to confirm the configuration</span>
<span class="go">{&quot;services&quot;: {&quot;email&quot;: {&quot;length&quot;: 12, &quot;repeat&quot;: 3, &quot;lower&quot;: 1, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0}, &quot;bank&quot;: {&quot;length&quot;: 5, &quot;lower&quot;: 0, &quot;upper&quot;: 0, &quot;number&quot;: 5, &quot;space&quot;: 0, &quot;dash&quot;: 0, &quot;symbol&quot;: 0}, &quot;work-2024Q4&quot;: {&quot;length&quot;: 8, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0, &quot;dash&quot;: 1, &quot;symbol&quot;: 0}}}</span>
</code></pre></div>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>-p<span class="w"> </span>email
<span class="go">Passphrase: [[I am an insecure master passphrase, but easy to type.]]</span>
<span class="go">kEFwoD=C?@+7</span>
<span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>-p<span class="w"> </span>bank
<span class="go">Passphrase: [[I am an insecure master passphrase, but easy to type.]]</span>
<span class="go">98517</span>
<span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>-p<span class="w"> </span>work-2024Q4
<span class="go">Passphrase: [[I am an insecure master passphrase, but easy to type.]]</span>
<span class="go">-P268G0A</span>
</code></pre></div>
<p>We first reconfigure the <code>email</code> account to use the master SSH key.
<code>derivepassphrase</code> presents us with a key selector for all SSH keys suitable for passphrase derivation, including the one we generated earlier.</p>
<div class="admonition quote">
<div class="tabbed-set tabbed-alternate" data-tabs="5:2"><input checked="checked" id="__tabbed_5_1" name="__tabbed_5" type="radio" /><input id="__tabbed_5_2" name="__tabbed_5" type="radio" /><div class="tabbed-labels"><label for="__tabbed_5_1">Only one suitable key</label><label for="__tabbed_5_2">Multiple suitable keys</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<p>We confirm the selection.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>-k<span class="w"> </span>email
<span class="go">Suitable SSH keys:</span>
<span class="go">[1] ssh-ed25519 ...gm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2  vault key</span>
<span class="go">Use this key? [[yes]]</span>
</code></pre></div>
</div>
<div class="tabbed-block">
<p>We choose the correct key.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>-k<span class="w"> </span>email
<span class="go">Suitable SSH keys:</span>
<span class="go">[1] ssh-ed25519 ...gm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2  vault key</span>
<span class="go">[2] ssh-rsa ...YAWfeXycsvJZ2uaYRjMdZeJGNAnHLUGLkBscw5aI8=  some other key</span>
<span class="go">Your selection? (1-2, leave empty to abort): [[1]]</span>
</code></pre></div>
</div>
</div>
</div>
</div>
<p>We confirm that the reconfiguring has worked because the configuration for the <code>email</code> service now references the key we selected earlier.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--export<span class="w"> </span>-
<span class="go">{&quot;services&quot;: {&quot;email&quot;: {&quot;key&quot;: &quot;AAAAC3NzaC1lZDI1NTE5AAAAIIF4gWgm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2&quot;, &quot;length&quot;: 12, &quot;repeat&quot;: 3, &quot;lower&quot;: 1, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0}, &quot;bank&quot;: {&quot;length&quot;: 5, &quot;lower&quot;: 0, &quot;upper&quot;: 0, &quot;number&quot;: 5, &quot;space&quot;: 0, &quot;dash&quot;: 0, &quot;symbol&quot;: 0}, &quot;work-2024Q4&quot;: {&quot;length&quot;: 8, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0, &quot;dash&quot;: 1, &quot;symbol&quot;: 0}}}</span>
</code></pre></div>
<p>We further confirm that the derived passphrase adheres to the rules laid out for the <code>email</code> service.
Since we configured the service correctly, <code>derivepassphrase</code> knows to automatically use our previously selected SSH key.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>email
<span class="go">BNbSA\E]#s8H</span>
</code></pre></div>
<div class="admonition note">
<p class="admonition-title">Reminder: reproducibility</p>
<p>Unless you are using our SSH test key, <strong>your SSH key will differ from ours, as will the derived passphrases</strong>.</p>
</div>
<p>We can now log in to our email account with the old passphrase
(<code>derivepassphrase vault -p email</code>) and change it to the new one
(<code>derivepassphrase vault email</code>).</p>
<h2 id="using-the-master-ssh-key-by-default">Using the master SSH key by default<a class="headerlink" href="#using-the-master-ssh-key-by-default" title="Permanent link">&para;</a></h2>
<p>To get the other two services to use the master SSH key as well, we <em>could</em> reconfigure them manually, as we did with the <code>email</code> service.
However, that is unnecessarily repetitive.
Instead, we will set up <code>derivepassphrase</code> to use this master SSH key by default.</p>
<div class="admonition quote">
<div class="tabbed-set tabbed-alternate" data-tabs="6:2"><input checked="checked" id="__tabbed_6_1" name="__tabbed_6" type="radio" /><input id="__tabbed_6_2" name="__tabbed_6" type="radio" /><div class="tabbed-labels"><label for="__tabbed_6_1">Only one suitable key</label><label for="__tabbed_6_2">Multiple suitable keys</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>-k
<span class="go">Suitable SSH keys:</span>
<span class="go">[1] ssh-ed25519 ...gm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2  vault key</span>
<span class="go">Use this key? [[yes]]</span>
</code></pre></div>
</div>
<div class="tabbed-block">
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>-k
<span class="go">Suitable SSH keys:</span>
<span class="go">[1] ssh-ed25519 ...gm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2  vault key</span>
<span class="go">[2] ssh-rsa ...YAWfeXycsvJZ2uaYRjMdZeJGNAnHLUGLkBscw5aI8=  some other key</span>
<span class="go">Your selection? (1-2, leave empty to abort): [[1]]</span>
</code></pre></div>
</div>
</div>
</div>
</div>
<p>The selected key will then appear in the <code>global</code> section of the configuration.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--export<span class="w"> </span>-
<span class="go">{&quot;global&quot;: {&quot;key&quot;: &quot;AAAAC3NzaC1lZDI1NTE5AAAAIIF4gWgm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2&quot;}, &quot;services&quot;: {&quot;email&quot;: {&quot;key&quot;: &quot;AAAAC3NzaC1lZDI1NTE5AAAAIIF4gWgm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2&quot;, &quot;length&quot;: 12, &quot;repeat&quot;: 3, &quot;lower&quot;: 1, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0}, &quot;bank&quot;: {&quot;length&quot;: 5, &quot;lower&quot;: 0, &quot;upper&quot;: 0, &quot;number&quot;: 5, &quot;space&quot;: 0, &quot;dash&quot;: 0, &quot;symbol&quot;: 0}, &quot;work-2024Q4&quot;: {&quot;length&quot;: 8, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0, &quot;dash&quot;: 1, &quot;symbol&quot;: 0}}}</span>
</code></pre></div>
<p>The <code>email</code> account still has an explicit configured SSH key, which overrides the global default setting; it just so happens that in this case both keys are the same.
We can therefore remove the useless key override from the <code>email</code> account.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>--unset<span class="o">=</span>key<span class="w"> </span>email
<span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--export<span class="w"> </span>-
<span class="go">{&quot;global&quot;: {&quot;key&quot;: &quot;AAAAC3NzaC1lZDI1NTE5AAAAIIF4gWgm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2&quot;}, &quot;services&quot;: {&quot;email&quot;: {&quot;length&quot;: 12, &quot;repeat&quot;: 3, &quot;lower&quot;: 1, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0}, &quot;bank&quot;: {&quot;length&quot;: 5, &quot;lower&quot;: 0, &quot;upper&quot;: 0, &quot;number&quot;: 5, &quot;space&quot;: 0, &quot;dash&quot;: 0, &quot;symbol&quot;: 0}, &quot;work-2024Q4&quot;: {&quot;length&quot;: 8, &quot;upper&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0, &quot;dash&quot;: 1, &quot;symbol&quot;: 0}}}</span>
</code></pre></div>
<p>The generated passphrase is still the same.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>email
<span class="go">BNbSA\E]#s8H</span>
</code></pre></div>
<p>Finally, the generated passphrases for the <code>bank</code> and <code>work-2024Q4</code> accounts are affected by the global SSH key as well, as intended.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>bank
<span class="go">06041</span>
<span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>work-2024Q4
<span class="go">PE1qg_M7</span>
</code></pre></div>
<p>However, <a href="../basic-setup-passphrase/#the-scenario">the new passphrase for the <code>work</code> account does not yet adhere to the company&rsquo;s passphrase policy</a> because <a href="../basic-setup-passphrase/#special-character">we are using the &ldquo;wrong&rdquo; special characters</a>.
We therefore change the passphrase generation parameters such that only dashes and no underscores are emitted.</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--config<span class="w"> </span>--lower<span class="o">=</span><span class="m">1</span><span class="w"> </span>work-2024Q4
<span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>work-2024Q4
<span class="go">pEY-qg7n</span>
</code></pre></div>
<p>We can then log into our bank and work accounts using the old passphrases (with <code>-p</code>) and change them to the new ones (without <code>-p</code>).</p>
<h2 id="summary">Summary<a class="headerlink" href="#summary" title="Permanent link">&para;</a></h2>
<p>We have reconfigured <code>derivepassphrase</code> (with the <code>vault</code> passphrase derivation scheme) for use with a master SSH key, and modified three existing accounts to use that key.
Our configuration should look like this:</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>--export<span class="w"> </span>-
<span class="go">{&quot;global&quot;: {&quot;key&quot;: &quot;AAAAC3NzaC1lZDI1NTE5AAAAIIF4gWgm1gJIXw//Mkhv5MEwidwcakUGCekJD/vCEml2&quot;}, &quot;services&quot;: {&quot;bank&quot;: {&quot;dash&quot;: 0, &quot;length&quot;: 5, &quot;lower&quot;: 0, &quot;number&quot;: 5, &quot;space&quot;: 0, &quot;symbol&quot;: 0, &quot;upper&quot;: 0}, &quot;email&quot;: {&quot;length&quot;: 12, &quot;lower&quot;: 1, &quot;number&quot;: 1, &quot;repeat&quot;: 3, &quot;space&quot;: 0, &quot;upper&quot;: 1}, &quot;work-2024Q4&quot;: {&quot;dash&quot;: 1, &quot;length&quot;: 8, &quot;lower&quot;: 1, &quot;number&quot;: 1, &quot;space&quot;: 0, &quot;symbol&quot;: 0, &quot;upper&quot;: 1}}}</span>
</code></pre></div>
<p>We should also get the following output when asking for those passphrases again:</p>
<div class="highlight"><pre><span></span><code><span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>email
<span class="go">BNbSA\E]#s8H</span>
<span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>bank
<span class="go">06041</span>
<span class="gp">$ </span>derivepassphrase<span class="w"> </span>vault<span class="w"> </span>work-2024Q4
<span class="go">pEY-qg7n</span>
</code></pre></div>
<p>This completes the tutorial.</p>
<aside>
<details class="abstract">
<summary>Image credits</summary>
<ul>
<li>The <code>pageant</code> logo is part of the PuTTY software package, generated from source files contained within.
  <a href="https://git.tartarus.org/?p=simon/putty.git;a=blob;f=LICENCE;h=091556577ce55d3502f121460668c5495de91baa;hb=refs/tags/0.83" title="License for the PuTTY software suite (and icons)">License</a></li>
</ul>
</details>
</aside>
<div class="footnote">
<hr />
<ol>
<li id="fn:no-support">
<p>If &ldquo;master SSH key&rdquo; is not listed as a supported feature, then this <code>derivepassphrase</code> installation cannot use master SSH keys.
Sorry.
This likely means that we cannot talk to the SSH agent because it uses a communication channel that we cannot or don&rsquo;t know how to access.&#160;<a class="footnote-backref" href="#fnref:no-support" title="Jump back to footnote 1 in the text">&#8617;</a></p>
</li>
<li id="fn:key-rotation-def">
<p><dfn>key rotation</dfn>: the exchange of a cryptographic key against a newer one, for the same purpose/access/capabilities as the old one, as a matter of policy, to artificially limit the scope of the old key.
Usually done on a schedule.
Typical policy reasons include protection against loss of access to the key material, and upgrades to different algorithms or key sizes (where possible).&#160;<a class="footnote-backref" href="#fnref:key-rotation-def" title="Jump back to footnote 2 in the text">&#8617;</a></p>
</li>
<li id="fn:test-key-comment">
<p>Technically, we are lying about the key comment you will be seeing when using our test key.&#160;<a class="footnote-backref" href="#fnref:test-key-comment" title="Jump back to footnote 3 in the text">&#8617;</a></p>
</li>
</ol>
</div>

</article>
            </div>
          
          
        </div>
        
      </main>
      
        <footer class="md-footer">
  
    
      
      <nav class="md-footer__inner md-grid" aria-label="Footer" >
        
          
          <a href="../basic-setup-passphrase/" class="md-footer__link md-footer__link--prev" aria-label="Previous: Setting up derivepassphrase vault for three accounts, with a master passphrase">
            <div class="md-footer__button md-icon">
              
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
            </div>
            <div class="md-footer__title">
              <span class="md-footer__direction">
                Previous
              </span>
              <div class="md-ellipsis">
                Setting up derivepassphrase vault for three accounts, with a master passphrase
              </div>
            </div>
          </a>
        
        
          
          <a href="../../how-tos/" class="md-footer__link md-footer__link--next" aria-label="Next: How-to overview">
            <div class="md-footer__title">
              <span class="md-footer__direction">
                Next
              </span>
              <div class="md-ellipsis">
                How-to overview
              </div>
            </div>
            <div class="md-footer__button md-icon">
              
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg>
            </div>
          </a>
        
      </nav>
    
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
    <div class="md-copyright__highlight">
      Copyright &copy; 2026 Marco Ricci (the-13th-letter)
    </div>
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
    and
    <a href="https://mkdocstrings.github.io/python/" target="_blank" rel="noopener">
        mkdocstrings-python
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    
    
    
    
  </body>
</html>

derivepassphrase.git

Deployed 4d028b5c74e3 to 0.x with MkDocs 1.6.1 and mike 2.1.4