GOKEY(1) | Gokey’s Manual | GOKEY(1) |
gokey - A simple vaultless password manager in Go
gokey [OPTIONS]
gokey is a password manager, which does not require a password vault. Instead of storing your passwords in a vault it derives your password on the fly from your master password and supplied realm string (for example, resource URL). This way you do not have to manage, backup or sync your password vault (or trust its management to a third party) as your passwords are available immediately anywhere.
gokey can generate passwords and cryptographic private keys (ECC and RSA keys are currently supported). However, without any additional options specified it uses your master password as a single source of entropy for generated data. For passwords it is acceptable most of the time, but keys usually have much higher entropy requirements.
For cases, where higher entropy is required for generated passwords/keys, gokey can use a seed file (a blob with random data) instead of the master password as a source of entropy.
In simple mode passwords are derived directly from your master password and the realm string. That is each unique combination of a master password and a realm string will produce a unique password.
For example, if your master password is super-secret-master-password and you want to generate a password for example.com, you would invoke gokey like
gokey -p super-secret-master-password -r example.com
If you need a password for a different resource, example2.com, you would change the real string
gokey -p super-secret-master-password -r example2.com
This way you need to remember only your master password and you can always recreate passwords for your services/resources.
NOTE: In this mode generated passwords are as strong as your master password, so do have your master password strong enough. You can also derive private keys from your master password, but keep in mind, that these keys will have low entropy. That is why it is considered unsafe, so gokey does not allow it by default. If you’re really know what you are doing, you can override this default by supplying -u flag.
If you plan to generate not only passwords, but also private keys or you want to have your passwords/keys with higher entropy, you can use a seed file instead of the master password. You still need to supply a master password, when invoking gokey, but it will be used only to protect the seed file itself; all generated passwords/keys will be derived from the data in the seed file. gokey uses seed files protected (encrypted) with your master password, so it is reasonably safe to store/backup seed files to a third party location, such as Google Drive or Dropbox.
To generate an encrypted seed file, use
gokey -p super-secret-master-password -t seed -o seedfile
This will create a seed file seedfile with 256 bytes of random data. The data is encrypted using AES-256-GCM mode and super-secret-master-password as a key.
Then, to generate EC-256 private key for example.com, use
gokey -p super-secret-master-password -s seedfile -r example.com -t ec256
Ignat Korchagin <ignat@cloudflare.com>
2018-06-06 | gokey |