Owner Key vs Master Password / Offline Private Key Derivation from Master Password / Public Key Derivation from Private Key

Repository

https://github.com/steemit/steem

What Will I Learn?

• Difference between Owner Key and Master Password
• Private Key Derivation from Master Password (Offline)
• Public Key Derivation from Private Key (Offline)

Requirements

• Steem Official Python library (https://github.com/steemit/steem-python) or
• Steem Beem Python library (https://github.com/holgern/beem) by holger80
• How to install the above library and run Python codes. But even for those who don't know, I'll make an explanation in details, so still it may be worth to read if you're interested in the concept.

Tutorial Scripts are compatible with both libraries for convenience.

Difficulty

• Basic (to follow)
• Intermediate (conceptually)

Tutorial Contents

Owner Key vs Master Password

One common misunderstanding of Steem (private) keys and master password is the difference between Owner Key and Master Password.

The recently launched official Steemit Wallet page (https://wallet.steemit.co) also uses a bit confusing term "master key" as follows:

Ambiguous wording "The owner key is the master key" on https://wallet.steemit.co

This may sound like the owner key is the same as the master password, which is NOT. Moreover, technically there is no such a thing, master key. It's just a metaphorical expression to indicate that the owner key is the highest-level private key.

There may be some reasons behind the confusion between owner key and master password.

1. The owner key can still change the master password.
2. There was no easy way to see your private owner key. (before the introduction of https://wallet.steemit.co) Of course there have been some unofficial sites and tools that you can check your private owner key, but not many people know that and not many feel safe to enter their master password to see their private owner key.
   

steemit.com doesn't provide a way to see the private owner key.

Fundamental differences between Owner Key and Master Password

• Master password is NOT a (private) key of (public/private key system). As the name suggests, it is a password. There is no such a thing like public master key, for instance.
• All private keys (and thereby all public keys) can be derived from the master password.
• Any private key cannot be derived from the owner key.

While the owner key is the highest-level private key, that doesn't mean other private keys (posting, active, memo) can be derived from the owner key. Each key is completely independent in terms of the PKI key pair. The fact that some higher-level key has more (i.e., inclusive) privileges than a lower-level key is completely different story. It is just a matter of implementation.

Private Key Derivation from Master Password (Offline)

Another common misunderstanding is that the internet connection is needed to get the private keys from the master password. But this is not true. One reason why some people may think the internet connection is needed is that steempy (CLI of steem Python library) or beempy (CLI of beem Python library) requires the internet connection when they import accounts. You can check this if you disconnect the internet and then try
steempy importaccount [accountname] or beempy importaccount [accountname] depending on the library you're using.

However, the reason why they need to be online is that they verify the public key with Steem blockchain to figure out whose key it is. That's how when you type steempy listaccounts, it shows the account name.

+------------------+---------+-------------------------------------------------------+
| Name             | Type    | Available Key                                         |
+------------------+---------+-------------------------------------------------------+
| blockchainstudio | active  | STM7twwbBgfpw7taJ6CoGe7Xp4qeXjdEVUzJgszSoqjqnnLByP8JW |
| blockchainstudio | posting | STM7mWpvHgJCXX62nXnSwW74GSBf2PYqzRWzdSxMP8G23ZQoV68q9 |
+------------------+---------+-------------------------------------------------------+

a typical output of `steempy/beempy listaccounts

But private key derivation itself (from the master password) can be done offline

Basically, the master password (together with your account name) is a seed to generate all private keys (public keys are derived from private keys). Try the following script with disconnecting the internet if you don't believe me :)

try: from beemgraphenebase.account import PasswordKey
except:
    from steem.steem import Steem
    from steembase.account import PasswordKey
import getpass

roles = ["posting", "active", "memo", "owner"]

print("Warning! This will show your private keys on the screen if you enter your master password correctly.")
print("To show that key derivations can be done offline, it will not check whether the password is correct.")

account = input("Enter account name: ")
password = getpass.getpass("Enter master password: ")

for role in roles:
    print("%s key" % role)

    pk = PasswordKey(account, password, role=role)

    print("  public:  %s" % pk.get_public())
    print("  private: %s" % pk.get_private())

https://github.com/economicstudio/steemtutorial/blob/master/showkeys.py

It doesn't echo your master password. Don't worry. Of course, it shows your private keys (as it warned) on the screen, so you need to execute this on a safe computer. If you don't feel safe, then just read the next paragraph :)

$ python showkeys.py
Warning! This will show your private keys on the screen if you enter your master password correctly.
To show that key derivations can be done offline, it will not check whether the password is correct.
Enter account name: blockchainstudio
Enter master password:
posting key
  public:  STM85THF8tgJpGDkpzfNKT6zE25iWHnhkg4pJDEEDqiKXL6fYqUgL
  private: 5JZDBCRM8Fyci7dJQ8c2mC9b8FsXd8aGeQH2X5EeN3Ki3dpAL5r
active key
  public:  STM5pxmDyb4urZFsUX7LxjQDuaVJ2TL4w7C9hfsVejhhCm6LJ1Hmg
  private: 5JArscMjtf3S2uKyL6i286piohE2dhh8Kvmyh4wSFZoaoKJPDfJ
memo key
  public:  STM8LhNWYfbDbyG8TWQUMPid4DfexANQNg4q2LDWb7EF2i123Do7L
  private: 5JuMLWnyhBRcxkeRmY18EKFEC7avU68jGR2scjyyTXDWpKKwmhf
owner key
  public:  STM8KXYhzrrdfbCShuN2PWVWAEXSwmGFnCKCYAWVYSqTMBD2KVpqw
  private: 5JvLoxtWQ9SeGfmb7ZPrYgGzCNGJ9eqMjwCUtmkuyEd3DXkd6zu

Example output of showkeys.py script

Wait a sec, why am I showing my private keys? Of course, they're fake :) In principle, you can actually enter any fake combination of account name and master password. Of course, in that case, the generated private keys are also incorrect one. Garbage In Garbage Out :)

Of course, if public keys happen to match some real public keys, you're extremely lucky! Then you can control that account, but the chance is virtually none. All cryptocurrencies are based on this belief.

If you enter account/password correctly, it gives the correct private/public keys. You can verify them on steemit.com, wallet.steem.co, steemd.com.

Due to the output, you may think that public keys are also directly derived from the master password, which is not true.

Public Key Derivation from Private Key (Offline)

A public key can be derived from a private key.

If you're familiar with PKI (Public Key Infrastructure) which is basically the cryptography that almost all cryptocurrencies are using, then you know that keys are a pair: public key and private key. And mathematically, a public key can be derived from a private key. For instance, Bitcoin address is a sort-of public key. When you enter your private key for that address, the wallet shows your address (public key), even if you didn't enter the address! This is because the public key is derived from the private key.

Let's confirm this with Steem blockchain! Again, no internet connection is needed.

try: from beemgraphenebase.account import PrivateKey
except:
    from steem.steem import Steem
    from steembase.account import PrivateKey
import getpass

wif = getpass.getpass("Enter any private key: ")

print("public key: %s" % PrivateKey(wif).pubkey)

https://github.com/economicstudio/steemtutorial/blob/master/derivepubkey.py

Feel free to type your real private key (it will not echo). Then it shows your public key.

$ python derivepubkey.py
Enter any private key:
public key: STM7mWpvHgJCXX62nXnSwW74GSBf2PYqzRWzdSxMP8G23ZQoV68q9

example output with a real private posting key of @blockchainstudio You can double check the public key on https://steemd.com/@blockchainstudio

Hope this tutorial clarify the confusion between owner key and master password, and also help understanding the underlying public key cryptography in almost all blockchains.

Curriculum

• Steemconnect login with posting key instead of active key

Proof of Work Done

https://github.com/economicstudio/steemtutorial