Quick sharding mnemonics without a wizard #61

New Issue

Closed

opened 2025-01-14 21:59:41 +00:00 by ryan · 5 comments

ryan commented

2025-01-14 21:59:41 +00:00

Owner

keyfork mnemonic generate --size 256 --shard --certificates ./certificates --threshold 3 --max 5

``` keyfork mnemonic generate --size 256 --shard --certificates ./certificates --threshold 3 --max 5 ```

ryan commented

2025-01-14 22:00:32 +00:00

Author

Owner

Note that this is functionally equivalent to:

keyfork mnemonic generate --size 256 | keyfork shard split --threshold 3 --max 5 ./certificates

Note that this is functionally equivalent to: ``` keyfork mnemonic generate --size 256 | keyfork shard split --threshold 3 --max 5 ./certificates ```

ryan commented

2025-01-14 22:24:07 +00:00

Author

Owner

We can also include an --encrypt-to option to encrypt a mnemonic to a previously-known disaster recovery certificate, that works either independently of, or in combination with, the previous shard commands.

We can also include an `--encrypt-to` option to encrypt a mnemonic to a previously-known disaster recovery certificate, that works either independently of, or in combination with, the previous shard commands.

ryan commented

2025-01-14 23:07:35 +00:00

Author

Owner

keyfork mnemonic generate --size 256 --shard --certificates ./certificates --threshold 3 --max 5 --encrypt-to dr1.asc --encrypt-to dr2.asc,output=dr2-new-filename.asc --shard-to shard1.asc --shard-to shard2.asc,output=shard2-new-filename.asc

dr1 and dr2 are OpenPGP certificates. shard1 and shard2 are previously-created Shardfiles. certificates are OpenPGP certificates used for sharding. An operator for every shard must be present to decrypt the same metadata packet, with the same certificates and m-of-n threshold being reused.

``` keyfork mnemonic generate --size 256 --shard --certificates ./certificates --threshold 3 --max 5 --encrypt-to dr1.asc --encrypt-to dr2.asc,output=dr2-new-filename.asc --shard-to shard1.asc --shard-to shard2.asc,output=shard2-new-filename.asc ``` `dr1` and `dr2` are OpenPGP certificates. `shard1` and `shard2` are previously-created Shardfiles. `certificates` are OpenPGP certificates used for sharding. An operator for every shard must be present to decrypt the same metadata packet, with the same certificates and m-of-n threshold being reused.

ryan commented

2025-01-16 21:32:42 +00:00

Author

Owner

keyfork mnemonic generate --size 256 --encrypt-to-self backup.asc can be used in combination with (for example) --provision openpgp-card,count=2,account=1,output=cert.asc to disable outputting the mnemonic and instead provisioning to OpenPGP cards.

`keyfork mnemonic generate --size 256 --encrypt-to-self backup.asc` can be used in combination with (for example) `--provision openpgp-card,count=2,account=1,output=cert.asc` to disable outputting the mnemonic and instead provisioning to OpenPGP cards.

ryan commented

2025-01-27 17:01:09 +00:00

Author

Owner

Closed by: c232828290

Closed by: https://git.distrust.co/public/keyfork/commit/c232828290f9e5a6b2e1db713ce1a5fe69c01aef