utils: move derive secrets to utils