trezor-totp

TOTP/HOTP secrets encrypted at rest, decryptable only via a Trezor device touch (+ PIN, if set). No authenticator app, no plaintext secret on disk — the AES key is derived on-device from a fixed BIP32 node and never leaves the Trezor.

Built on CipherKeyValue (trezorlib.misc.encrypt_keyvalue / decrypt_keyvalue), the same primitive the legacy Trezor Password Manager used.

Setup

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Requires a Trezor with USB access configured (udev rules / plugdev group — see git-crypt-trezor-setup step 2 for the same udev setup).

Usage

./run.sh add github --secret JBSWY3DPEHPK3PXP   # confirm + PIN on device
./run.sh code github                             # decrypt via device, print current code
./run.sh list
./run.sh remove github

Omit --secret to be prompted (avoids the secret landing in shell history).

Vault: ~/.trezor-totp/vault.json — only ciphertext + IV per entry, nothing usable without the device.

Notes

• Tested against: Trezor One, firmware 1.12.1, trezor (trezorlib) 0.20.1, pyotp 2.10.0.
• PIN entry (if enabled) is a position cipher — see the git-crypt-trezor-setup skill's explanation, same mechanism.
• Each entry uses a distinct key label (trezor-totp:<name>) under one fixed BIP32 node (m/13'/0'), so entries are cryptographically independent even though they share a path.