octez-client: Import keys from mnemonic gives a different address

Question

I am using octez-client to import keys using a mnemonic phrase:

echo -e 'twelve word mnemonic here\npassphrase here\n' | octez-client import keys from mnemonic my_alias -f

I have checked that I can import my wallet using the Kukai.app wallet and there I wasn't prompted for a passphrase. Thus I attempted an empty passphrase with octez-client:

echo -e 'twelve word mnemonic here\n\n' | octez-client import keys from mnemonic my_alias -f

The above command runs and I get some secret keys, but they are for the wrong account and it changes if I try to change the passphrase.

What am I missing here to make the key import work the same as on Kukai?

If you happen to know how I can import a hd-wallet.tez file to tezos-client that would also be a work-around I could use.

Edit

Many thanks. I was helped by the tip of going via Temple wallet which imports the mnemonic and can reveal the unencrypted key. As additional steps, I had to prepend the key with the scheme unencrypted:edsk. To finally get the key encrypted and imported to octez-client I ran:

octez-client encrypt secret key
 octez-client import secret key my_alias encrypted:edeskEncryptedKeyHere

Answer 1

Kukai uses BIP-32 HD Keys. As a workaround, you can export your mnemonic to the Temple Wallet and "Reveal Private Key" there. Or you can use any SDK, working with HD Keys. For instance, you can use Netezos SDK:

var hdKey = HDKey.FromMnemonic(new Mnemonic("clarify flash mansion forward turtle dinner drill turkey dry draw kidney brain fruit tiny aspect"));
var childHdKey = hdKey.Derive("m/44'/1729'/0'/0'");
Console.WriteLine($"Private key: {childHdKey.Key.GetBase58()}");
Console.WriteLine($"Address: {childHdKey.Address}");

An example at .NET Fiddle

Answer 2

A slight correction to the answer above

Kuaki uses Slip10 HD keys for tz1 keys and bip32 HD keys for tz2/3

the reason why octez-client does not return your same account is that it does not return HD keys

your mnemonic does not go through any derivations like in the step var childHdKey = hdKey.Derive("m/44'/1729'/0'/0'"); default for tezos is 44'/1729' and the latter specify which child to derive.

Kukai has derived your child account down to 44'/1729'/0'/0'

This all being said, the secret key is the fastest way to get your account onto octez-client which can be found in the methods listed in the previous answer.

Temple (to me) would be the fastest way to find your accounts secret key.