DKMS Key Derivation Visualizer
How Ritual agents derive identity keys — visual reference
Derivation parameters
The unique identifier for your agent on Ritual
TEE Master Root
Hardware-protected seed
The root secret is generated inside a Trusted Execution Environment. It never leaves the enclave and is never exposed to the host OS or operator.
(sealed inside TEE)Chain-derived Master
DKMS precompile (0x081B)
The master key is deterministically derived from the TEE root using the DKMS precompile. This key is chain-specific and tied to the Ritual network.
keccak256(tee_root ‖ "ritual-chain")Agent Identity: my-agent-001
Agent-specific derivation
Each agent gets its own keypair derived from the master using the agent ID as the derivation path. Two agents never share keys, even if managed by the same TEE.
keccak256(master ‖ "my-agent-001")Purpose Key: signing
Signing / encryption / auth
The final key is derived for a specific purpose. Signing keys cannot be used for encryption, and vice versa — this separation is enforced by the derivation path.
keccak256(agent_key ‖ "signing")Security properties
Keys never leave the TEE
All derivation happens inside the enclave. The host OS, operator, and even the Ritual Foundation cannot extract the private keys.
Deterministic derivation
The same inputs always produce the same keys. If a TEE restarts, it regenerates the same keys from the sealed root — agents keep their identity across revivals.
Purpose isolation
Signing keys, encryption keys, and authentication keys are derived with different paths. A compromised signing key cannot decrypt secrets.
Agent isolation
Each agent derives from its own path. One compromised agent does not affect others, even if they share the same TEE.
About the Dkms Visualizer
Ritual agents get their identity through DKMS — Decentralized Key Management System. Keys are derived deterministically inside Trusted Execution Environments (TEEs), so agents keep the same identity across restarts and revivals without anyone ever seeing the private key.
This visualizer shows the derivation chain: from the TEE-held root, through the chain-specific master, to agent-specific keys and purpose-specific keys. Adjust the agent ID and purpose to see how the derivation path changes.
- Interactive — adjust agent ID and purpose to see path changes
- Shows the exact derivation formula at each level
- Explains security properties (TEE isolation, determinism, purpose separation)
- Educational reference for DKMS and TEE key management
How to use
- Enter your agent ID (the unique identifier on Ritual).
- Select the key purpose (signing, encryption, authentication).
- Review the 4-level derivation chain.
- Read the security properties below for why this matters.
Frequently Asked Questions
What is DKMS? ▾
Decentralized Key Management System — keys are derived deterministically from a root held inside a TEE (Trusted Execution Environment). The private key never exists outside the enclave, but the same keys are regenerated on every boot from the sealed root.
Why does determinism matter for agents? ▾
When a Ritual agent dies and gets auto-revived from its checkpoint, it regenerates the same identity keys from the TEE root. This means the agent keeps its on-chain identity, can still sign transactions, and can still decrypt its secrets — despite having been completely restarted.
Is this tool free to use? ▾
Yes! This tool is 100% free. No signup, no credit card, no limits. It's part of Formatho's privacy-first developer toolkit.
Is my data safe? Does this tool send data to a server? ▾
Absolutely. This tool runs entirely in your browser. Your data never leaves your device. Zero server-side processing, zero tracking.