# Key Derivations
###### tags: `keys` `deepkey` `dpki`

> Resources :
> - https://github.com/holochain/holochain-rust/tree/develop/sodium/src
> - https://github.com/holochain/n3h/tree/master/packages/mosodium/lib

- Seed Derivation
- Seed Derivation Rust Library
- Seed Derivation CommandLine that can connect to lib
- Container (Installation?? First Launch??) DeepKey UI
- connection to seed derivation lib
- Generating new Root Seed (give mnemonic, and bundles)
- Connecting to an existing Root Seed (input device bundle)
- Adding additional device bundles (or app keypairs) (involves PINs)

## Three Derivation processes:

### 1. Read only / One Time
This Key derivation is used to for anonymous browsing connections until someone validates their identity using email/password combo.
Key notes:
- We generate throw away signing keys
- We don't track these Keys in DeepKey
- DECISION : Anonymous keys will get entropy from salt mine and generate a one-time throw away key.
- New header from base32
- We can store them in local storage in browser (No prob)
- We could use the same key for every anonymous app connection (don't care)

### 2. Grandma keys (Browser Keys)
DECISION: For Closed Alpha signup process we only need to register the email address in the salt-mine, we don't need to send a verification link via email.

This Key derivation is when a Holo user decides to make a write call in the hApp

- For this key generation we use the salt with password hashed
- Password and DNA concat and sha256
- Seed first key derevation -> generates App key
- HOW to gen REVOCATION KEY
- DEEP KEY DNA :

### 3. Holochain DPKI w/ DeepKey

When a person wants to use Holochain rather than Holo they will need to install Holochain on their device. To make this straight forward the Electron app [Holosqape](!https://github.com/holochain/holoscape) has been built. Holosqape comes with DeepKey, Personas & Profiles and Peer Chat as a "Bundle". DeepKey + Personas & Profiles is known as Identity Manager. The person using it will setup their keys and then a profile for Peer Chat and then be able to chat with others using Peer Chat either on Holo or Holosqape.

The ```[dpki]``` setting in the conductor-config.toml tells Holochain which instance of a dpki hApp to use for key management and is used to bootstrap Holochain during the step that commits the Agent Key to the soource chain. In our case we will be using DeepKey.

When Holosqape is first run on a device the Agent has a choice of 2 options:

> I don't really see having NO DPKI as an option. You can choose not to save your root seed for generating revocation or device seeds, and therefore as a human, opt out of taking advantage of the benefits of DPKI. HOWEVER, for security consistency, your system will still need to run Deepkey be able to tell whether OTHER PEOPLE's keys are valid or revoked or whatever.
> [name=Arthur Brock]
> Comments have been incorporated into text now
> [name=Philip Beadle]

hc: creates root_seed, device_seed, revocation_key and host_agent_key
Holoscape: Electron app people install
DeepKey: [dpki] hApp

### First Time Use Sequence
When a person first installs Holoscape and has no root key mnemonic.

sequenceDiagram

    Participant Person
    Participant Holoscape
    Participant hc
    Participant Conductor
    Participant DeepKey

    Person-->>Holoscape: Run Holoscape (or cmd line)
    Holoscape-->>Holoscape: Check for device_seed
    Holoscape-->>Person: First Use?
    Person-->>Holoscape: Yes
    Holoscape-->>hc: hc dpki-init
    hc-->>Person: Request passphrase
    Person-->>hc: Passphrase (secure domain socket)
    hc->>hc: Create root_seed
    Note over hc, Person: Note :This mnemonic can be used when you want to setup other devices.
    hc-->>Person: root_seed mnemonic
    hc->>hc: Derive revocation_key
   Note over hc, Person: Note :This mnemonic can be used when you want to revoke a key.
    hc-->>Person: revocation_key mnemonic
    hc->>hc: Derive device_seed
    hc->>hc: Derive device_authorization_key
    hc->>hc: Derive first_deepkey_agent_key
    hc->>hc: Save key_store file
    Holoscape->>Holoscape: Write conductor-config with key_store & agent_id
    Holoscape-->>Conductor: Start conductor read key_store
    Conductor-->>Conductor: Read key_store
    Conductor->>DeepKey: init_dpki(revocation_key)
    DeepKey->>DeepKey: Register Agent Key