Using Rust to seed RSA and X25519 cryptographic keys wrapped in a GPG certificate

4/3/2021

Sometime last year, I backed the DiceKeys project, and last month, my dice arrived. To summarize, there are 25 dice, each with 6 possible faces and 4 possible orientations, adding up to an astronomical number of possible combinations. The pitch is that you roll these dice generating real-world entropy, then lock them in place and put them somewhere safe. You then use the rolled dice as a seed to generate passphrases from, using what they call recipes (think of them as hash functions that produce passphrases).

So how is this different than using a password manager and why would you go through all the trouble? First, the dice aren't meant to replace your password manager, but can be used, for instance, to produce the primary passphrase you use with one. If you ever forget your passphrase, you just run your recipe again and regenerate the same passphrase. And from time to time, when you should update your password manager's primary passphrase, you just need to run the recipe with a different iteration value, which will result in a new seed, and thus, produce a new passphrase. It reduces cognitive load by providing a secure default process for passphrase generation. This makes it easier not to reuse the same primary passphrase with your personal password manager, your business password manager, your storage encryption, or anything else. It also makes it easier to rotate those passwords once in a while.

You don't even need to buy the physical dice, you can try the concept for yourself at https://dicekeys.app/. But you could, for instance, put the physical dice in a vault or safety security box.

Anyway, the software that supports the dice (including that website) is all open source but also fairly rudimentary. It's just an arbitrary application of the entropy that the dice generate by a function that produces passphrases; but what if you want to do something else with that entropy, like generate a reproducible cryptographic key? Turns out nobody wants you to do that and tools like openssl and gpg don't have any support for it, which made me want to do it all the more.

First, let me say that I think it's a very bad idea to seed a cryptographic key with a normal password. The reason it's safe to generate RSA or X25519 keys and feel reasonably certain that the key will be unique is that their algorithms are seeded by cryptographically secure pseudorandom number generators (CSPRNG). Now if we start using passwords to seed with instead, we dramatically reduce the pool of keys that are likely to be generated (due to average password lengths and characters), and thus, increase the chances of keys colliding. That being said, 1) I'm using the SHA hash of a passphrase, 2) I'm generating the passphrase itself from a source of real entropy, and 3) this seems to be a very niche thing to do so I'm not too worried about colliding against others doing it.

Okay, so how can we create keys from a passphrase? If you want to cheat, you can just install Rust then run cargo install cfs_openpgp, which will download cfs_openpgp, a little program I wrote for this purpose.

Here's a full usage example:

cfs_openpgp --username "Alice" --email "alice@example.com" --key-sig-time 0 --weeks-subkeys-exp-in 52 --secret "a super-secure secret phrase that's been generated from real entropy"

This command will output the ASCII-armored presentation of the PGP private certificate, public certificate, revocation signature, and each attached key and fingerprints (separate keys for certifying, signing, and encrypting, and two for authentication (RSA and x25519). The associated user will be alice@example.com, all keys will be signed as having been generated in 1970, and the subkeys will expire in a year. I've attached some sample output at the end of this post.

Honestly, it's just a thin wrapper around the sequoia_openpgp library (much thanks to Neal Walfield of the Sequoia project, who answered a million of my questions about the library). The code boils down to the generator functions. For instance, here's the one for the Ed25519 key:

pub fn ed25519_key_from_seed(salt: &str) -> Key<SecretParts, SubordinateRole> {
    let mut secret_phrase: String = get_secret_phrase();
    secret_phrase.push_str(salt);
    let key_from_seed = ed25519_private_key(&mut Yarrow::from_seed(&*Sha512::digest(
        secret_phrase.as_bytes(),
    )));
    Key::from(
        Key4::<SecretParts, SubordinateRole>::import_secret_ed25519(
            &*key_from_seed,
            get_key_creation_time(),
        )
        .unwrap(),
    )
}

On line 4, we set our SHA-hashed salted passphrase as the seed value for the CSPRNG, which results in a reproducible key. Then we wrap the resulting bytes up into a key, sign it, and attach it to our PGP certificate.

And that's all that there is to it.

The keys are really interesting and are well-suited for corporate use or with cryptocurrency wallets. It was also a great opportunity to continue working with Rust, which is a delight to program with!

Sample Output

PGP private certificate:

PGP public certificate:

PGP certificate revocation signature:

Keys:

Key ID C8D2D5C6D7FE7FC4100149DA369E3B2810AB798A (EdDSA Edwards-curve Digital Signature Algorithm): 

-----BEGIN PGP PRIVATE KEY BLOCK-----

x1gEAAAAABYJKwYBBAHaRw8BAQdAieNzsJ+6BApVuk4m/Z9G44MlhdaAXd4DsONp
Y7BWRIcAAQDU2Blrm8eeDIGB4NAfhqIejnRP1CRQnnZw3BstGHy3Bw7n
=xvtm
-----END PGP PRIVATE KEY BLOCK-----



Key ID F09EC7A545C9FC238B594ECD67A479A637224275 (RSA (Encrypt or Sign)): 

-----BEGIN PGP PRIVATE KEY BLOCK-----

x8ZXBAAAAAABEAC1ySm9qqnsLTvJC26shZnivqRLQQ487j8IrPxtq94Q0X7zY8yN
fhkU1GKSVjqYeSESsnF+nvaaBuE0KCYerbFWyjvrn6CIcN2xH5YudmbYD6r/HaH9
T6tprAOOPpE3BFSktpOjGSdkqiX3wzw/GcvYDV5M+hwxMC5ZI/WIx5CepTCfg2r2
FhKbUNw2hLkyuo2JndsF2QOhUp4GS1u2x8NAqPjdFQcLP582vthewGD0DcJ3ChXM
xcYZbsmy1iRPPDb5iPoXwMGCPNqp+DB9FehIAQlU0erd2M6uUFlY/Yw+a6qduvHE
v5Qw/UikSAu8ZUHOWqCqSqLYe1a8NLZ/I0Lyhk62sIBoeT2n7dNQR9SSxJ3Hgi85
1xXB0lIrLGHbR1t88rimaefn2zOcubW/XcQnY78L5PKfVXGL7iKxLoM+kl0FhZ5S
b5bfSbTjB3DmaY6EqTHTkYhl/04emxIPuKa9336pAUfLllddfxNDzveboV0W+132
4CXGrt7hTK2lAE/l1zZwiz8b2+9YQzWMMhVtVH1xkbSeeZwY+rsZz5IOA0IIRT8n
bXvw4NYDzsyEbEkd1riuYB6lOtiplQ/eRZsgiVLFBsokJgAT7Z3BXNXjHK57V0Zj
oQd2ymw4cvHwDP8ke0B1MlenC0toif9+SAfP7oORkdCnWsSNKqnEcwP8vQARAQAB
AA/1EQrK3v0g8QNMl4x607Gyu48j1+pBa3Tqc+XDxIRYTTtWq3qvspQfxdQjaZSr
6Z9xek9AVJ6Sf94lPr6E1Ft0RK6w72YHpsLuBazwZ2qyOY8+eKxOg3D0oPN/YdZ7
xqyhQs/bB29UQhuxc4jaHRBOC/M05AKOog3iSnkUi74p0LWr2Uh4vplTJTxvaK0I
r7jNjBlAb0vpCzazmeN2tawEogs1SYSvJF7Sjk9V+YwPitG/aWmIoano6Hl6b0mk
HcmHXd15lMB9Y7hQx5587T0giZ+PQGRtoF6zAaSGu9EJVNDDLgZYpBlRy0XziXM3
pnHXuYDFjzFwEtt9Rieq9EBaBjnyqQedFoh5/w1jsGkV8lPBu5qpiWjKAqBeGFaL
Ctlua86X6kr3876I/uO10gD+aJvO69aKFcf1U5Z5uBB2QSHaIrR90CkbaWTPA7M0
6wyCV5XW1Sfdg56oWB++eFLzAIj8UcccbT94ArGfe58TJw4QVGmOYwzCepOw2S+v
O8yncTLZAc2yGHdUyfx7ebAm+Rc9N4EIJt3Rxbl0AbycGOo96QKQxpQp0O5s4WKW
TlkJcyP6Z8330yi4wR+sXBiJw8+8SpwfeadxVFYQKFLVD+zyYEPnyyYaNPRIiKor
oRXqjzQXnGw7c/DkPw4F73TTOg9Txoh/kpDhTXKNdViYoQgAxMtEN4V0NSZsndpm
S+h9/XlR5psIJSdOj/9IDRPwFxdc+BCpfGVCrWbT+bIbUhW/S+9Ub3OgFZ0Xm94o
C0LxmM42ioquFzW9tLLtkNt97smh3c2i9dftat8lprzdv29g2QtzKRMMKlfhHjHG
872H5tGTUAgxJ8mAOMbjXKkfgCt3v+jCszZpNK7vEiXmuTUbVpJun/aPjHvQS9Er
mVLw5Ho+sXUjxGReSanqqizQhZXl0DIzS7xuSyijmC2BdN5KYCq1zmL6H+8tD2E9
CRrLOKLrfJach9rezH/msXNtnjhQxhYesoqTcZgHg15iql7Pn3kLu094WrkzdDyN
VcI7SwgA7Hn9YLmys2brATEBc6hFtPknF11bmR9O06CGQyncVeE9b9WeJBVdk0Tk
OHwRwv9XACoQkJUmf135KbaYtqeRTcFJCbjIDpBcPVLwCY7Qa4thyXUQqZP+EpoF
82QxP2k32+oYXkfmQnIP+h+aP/HSWDy+lzfp7CFNiZ4fP6q1rAHaVDYm5d8bmAhb
I4AOUi6aEP0QWcG6rW7NjIIhhQDiMH78OWGiHxNcP0Nwf6L/Qwq2IfX9ZbuAPzDy
TaffRyj9GSb2M/uXEZu+j2Hq3oGlI/MC7QR72kjMuLHHpKYKXkqdGOGmVs5nFga2
7mvhKuG23nbx/kAOUIzA4qONh1dbFwf+KEtMgivgtCKQJ8wY+YEdetzWe8uNaz57
UUdxwyfjnUj0276OHeW/YrYih9mB0YQcDgmgRRluhU5KI/M42y1jshmZ8CHhIYTv
PmgxepVPg+KBCwJgSW3HhkFWgcw/4Y4H/mg2JQWL0CygU5ojmWHpPah/8CsSR3vr
H/+IwERqabSktogy8lou3pGLYJINSNgyRwLVViuZ8SMlNUWwMU8FRDtJrxKdTMmE
H5WG48m+X/3zqT6hHJDtlhplSXMjsFidFNCkDWZsq2nSLORDwTYpVpS5XS6YPXWY
S2bpyh5sjaDN7SGwXRJAtVhsA5a7gagPScoPsIjJzThve3I3wq10aHYF
=x44D
-----END PGP PRIVATE KEY BLOCK-----



Key ID A69627806D3E8D10CDDADC6361E84E1D17A2CEAB (EdDSA Edwards-curve Digital Signature Algorithm): 

-----BEGIN PGP PRIVATE KEY BLOCK-----

x1gEAAAAABYJKwYBBAHaRw8BAQdABk9JqizKg6XrvFCnWBNzyXTgGnbuRkJ3x83D
3a+iLWoAAP9mGNqIDE/Wcs1XHIKQcFTw/AjgZK3RONJqAi5LawKRuw/2
=maQR
-----END PGP PRIVATE KEY BLOCK-----



Key ID 07E13CD52E40EAB51576290F0745B7ABDE0413AA (EdDSA Edwards-curve Digital Signature Algorithm): 

-----BEGIN PGP PRIVATE KEY BLOCK-----

x1gEAAAAABYJKwYBBAHaRw8BAQdAgxxaPSWsVTYPJn0Ug5mCc2hv+gG6OjUdHfis
YOWUFxMAAP92AA01sopsxey+4musFbrLC+dGBubLHfG2Zcyt6EIeJRFf
=vI+g
-----END PGP PRIVATE KEY BLOCK-----



Key ID 2EB11593B2A67320199D163F464746CC47D3CD67 (ECDH public key algorithm): 

-----BEGIN PGP PRIVATE KEY BLOCK-----

x10EAAAAABIKKwYBBAGXVQEFAQEHQHF4CesrBng/n2wmAh+50kDuRxB+HzhhSw8X
B6a9zmUnAwEKCQAA/3xBvH2D5BM+L6b16VEnMovQVZy9Pk743LILnDi7n7cwEUU=
=BJrx
-----END PGP PRIVATE KEY BLOCK-----