RE: Steem Basics: Understanding Private Keys

[gtg]

@oldtimer, @direwolf: No, they are not the same.
Owner Key is derived from the Master Password in a same way as Posting Key.

Let's say user bob is setting his new Master Password.
It will look like this: P5Hzer2h4R4Lkkjr455T4msnJyjwwmrjLLDYNATMAukM2yehVE6R.
Steem blockchain however, doesn't know anything about Master Password as such.
It uses keys, such as Posting Key, Active Key, Owner Key that are derived from the Master Password.
In such case bob will have:
Private Owner Key:
5JiD4BEytbFWMGeN3Zk9JfFFgFCTvfcDhDGReG7jt2DREY8JzMa
Private Active Key:
5K6p5g2ob577bA53qgLMGDGY3L3D7M4ccaY2qFSJppgEvJkeLFn
Private Posting Key:
5KW5yYgmPf7bRn6BFEWboLr9bj4QtmVJMNAm2SiErDN5BCGtWH5
How I know it? There's a cli_wallet functionality that lets you derive key pairs from the Master Password. It's used for convenience, as you need to securely store one, instead all four.
To derive Owner Key from Master Password, bob would need to use:
get_private_key_from_password bob owner P5Hzer2h4R4Lkkjr455T4msnJyjwwmrjLLDYNATMAukM2yehVE6R
Same for every role.

In fact you don't need to have Master Password at all. Your private keys can be generated and changed independently.

Comments

[direwolf]

What is a cli-wallet and where can I find it?

There's a cli_wallet functionality that lets you derive key pairs from the Master Password. It's used for convenience, as you need to securely store one, instead all four.
To derive Owner Key from Master Password, bob would need to use:
get_private_key_from_password bob owner P5Hzer2h4R4Lkkjr455T4msnJyjwwmrjLLDYNATMAukM2yehVE6R

[gtg]

cli_wallet is a command line tool, a part of https://github.com/steemit/steem
You can either build it yourself or extract it from a docker image.

[prinzvalium]

Thanks for the info. And where is the master password? Never seen it. I only got the four keys.

[gtg]

You get Master Password at the time of account creation through Steemit site (which I believe is what you got yours). You don't need it as long as you have all your private keys, or at least your private owner key, so you can set all the others.

[prinzvalium]

Is there a scenario, where the private owner key is not enough and where you need the master password? e.g. account recovery?

[gtg]

No. Steem blockchain doesn't know about your Master Password.
Master Password is like a Master Key, that allows you to open doors on all levels of the building. You can use that one or separate keys. Separate key for the highest level in the building is enough to open it.
Also, if you change the lock in that door, Master Key will no longer be able to open it.

[prinzvalium]

Ok. Now I know what's my error. I thought that I have the 4 private keys active, memo, posting and owner. I thought my password is missing. But: I do have the password and only the three private keys active, memo and posting. I don't know my owner private key, because it is not shown in the Steemit wallet. I think it is genarated automatically if I enter my password in Steemit.

Ist there a way to get the private owner key?

[gtg]

As far as I know, there's no way to get Private Owner Key from the Steemit website, most likely because it would be additional security risk.

"The private key or password for the owner key should be kept offline as much as possible"

However, for people that are using Master Password there's no much difference and no bigger risk (leaking Master Password is same as leaking all the keys, including Private Owner Key).

You can use get_private_key_from_password prinzvalium owner YourMasterPassword in cli_wallet (if you can manage to run it) to get your Private Owner Key from your Master Password, or just stop using Master Password (keep it offline, keep it secret, keep it safe), and just use Posting Key for day-to-day use cases, and Active Key only when you need to transfer funds or approve/unapprove witnesses etc.

[prinzvalium]

Thanks for your help! Now I'm feeling better :-)

[abusereports]

This spam is courtesy of @fulltimegeek! A real piece of shit who flags manual curation projects like @themadcurator because he's a spiteful cunt!!!