How to generate keys for authorities?

Question

This may be a dumb question because I don't understand the concept of session keys well enough and neither have extensive experience using shell loops: in substrate one finds this comment telling us how to generate keys for a network:

# stash, controller, session-key
# generated with secret:
for i in 1 2 3 4 ; do for j in stash controller; do subkey inspect "$secret"/fir/$j/$i; done; done
#
# and
#
for i in 1 2 3 4 ; do for j in session; do subkey --ed25519 inspect "$secret"//fir//$j//$i; done; done

In do for j in session what is session and how does one get it? Is it some sort of secret such that for one authority three keys distinct derivations are generated like the following?

1. $secret/stash-secret
2. $secret/controller-secret
3. $secret/session-secret

Answer 1

I recommend reading well written wikipage about different keys: https://wiki.polkadot.network/docs/learn-keys

Sessionkeys are hotkeys saved on your validator node. Normally generate them with RPC-command rotatekeys:

'curl -H "Content-Type: application/json" -d '\''{"id":1, "jsonrpc":"2.0", "method": "author_rotateKeys", "params":[]}'\'' http://localhost:9933 >> ~/sessionkeys.log && tail -1 ~/sessionkeys.log

This script saves your sessionkeys in log file every time you rotate them, but you can also find all the sessionkeys at /home/$USER/.local/share/polkadot/chains/$CHAIN/keystore

This looped command you have found seems to be more about inspecting existing keys. To generate stash and controller keys, you can repeat following subkey commnad twice and save the mnemonics.

subkey generate --network $NETWORK

Answer 2

I rewrite it another way, it's much easier to read:

for i in 1 2 3 4; 
do 
    for j in session; 
        do subkey inspect "$secret"//fir//$j//$i; 
    done; 
done

The output result:

Secret Key URI `//fir//session//1` is account: //here
  Network ID:        substrate 
 Secret seed:       0x68dcc9c2a71375c5fe58047ab26d2b1fdecbe9c289552cb8be3dbedf33ab7382
  Public key (hex):  0x4a95b20a23190ebe5edeadbeaaf3b254b24780ba7e9afebc0e04fbdb0d26d80c
  Account ID:        0x4a95b20a23190ebe5edeadbeaaf3b254b24780ba7e9afebc0e04fbdb0d26d80c
  Public key (SS58): 5DkVsP9rBeqgAWdse9nYATDAV9RWEky2xVBppAN9bzf34GVS
  SS58 Address:      5DkVsP9rBeqgAWdse9nYATDAV9RWEky2xVBppAN9bzf34GVS
Secret Key URI `//fir//session//2` is account: //here
  Network ID:        substrate 
 Secret seed:       0x17b13ce6e96657189bf1ec2572d51ec9bccbf80224ee2b9f52fdb67ab10670a0
  Public key (hex):  0xac1ea46ad5376593bf482ae09ed6911512cb7d39873e48c696a882252455d843
  Account ID:        0xac1ea46ad5376593bf482ae09ed6911512cb7d39873e48c696a882252455d843
  Public key (SS58): 5FxPCKXqnB77D2RyVaGbUL4un6aX1eCMvDf1v3W2nYU8pRXj
  SS58 Address:      5FxPCKXqnB77D2RyVaGbUL4un6aX1eCMvDf1v3W2nYU8pRXj
Secret Key URI `//fir//session//3` is account: //here
  Network ID:        substrate 
 Secret seed:       0xd7cb7a3f7a93fe88a74154583c55467b1c04bd8d59ce7fa11520ed58c0623a57
  Public key (hex):  0x169be3313d2d1061b4dca389ba6eea62d283ec02f8c985b729912e0d49db2164
  Account ID:        0x169be3313d2d1061b4dca389ba6eea62d283ec02f8c985b729912e0d49db2164
  Public key (SS58): 5CaMDeYr4KiP1dc1qZ4Q4ebtVBJ8z1SVpfi29bsgrwzBTmDs
  SS58 Address:      5CaMDeYr4KiP1dc1qZ4Q4ebtVBJ8z1SVpfi29bsgrwzBTmDs
Secret Key URI `//fir//session//4` is account: //here
  Network ID:        substrate 
 Secret seed:       0x10b4d4337294b10743a6deb817b43fb09817afb5b53859449a679189086ffb86
  Public key (hex):  0x341ff69c999f56c5e54f551c0a6a6a319b87deb53cc980ddd7420bfd51d62a36
  Account ID:        0x341ff69c999f56c5e54f551c0a6a6a319b87deb53cc980ddd7420bfd51d62a36
  Public key (SS58): 5DF3qobzyHw439qrDbVwr69QaEdNXkdcVN8hRpGJZDqhYNKb
  SS58 Address:      5DF3qobzyHw439qrDbVwr69QaEdNXkdcVN8hRpGJZDqhYNKb

In do for j in session what is session and how does one get it?

As you can see, the session is a literal string actually, and "$secret"/fir/$j/$i used to generate different mock secret key.