Deriving ephemeral authentication