keripy icon indicating copy to clipboard operation
keripy copied to clipboard

Rotation causes `toad` update by default

Open lenkan opened this issue 8 months ago • 3 comments

Version

1.2.4

Environment

No response

Expected behavior

The bt or toad value should remain the same when rotating keys for an identifier.

Actual behavior

The toad value is updated to the number of witnesses.

Steps to reproduce

See gist here: https://gist.github.com/lenkan/44022e4a0bc0f8fe600f373256920789

Output is:

Waiting for witness receipts...
Prefix  EBxFB0RDjcboqnWU_jcEW22lfgYom1oWPX4Unnwyn_j1
        Public key 1:  DPZd-fiwUEiqcLFmtVNR9iNtRSAt56T-x7J_dsWup0yK

##
## STATUS BEFORE ROTATE
##
Alias:  test_d4eb4a6f
Identifier: EBxFB0RDjcboqnWU_jcEW22lfgYom1oWPX4Unnwyn_j1
Seq No: 0

Witnesses:
Count:          3
Receipts:       3
Threshold:      2

Public Keys:
        1. DPZd-fiwUEiqcLFmtVNR9iNtRSAt56T-x7J_dsWup0yK

Waiting for witness receipts...
Prefix  EBxFB0RDjcboqnWU_jcEW22lfgYom1oWPX4Unnwyn_j1
New Sequence No.  1
        Public key 1:  DIuVROB3izTgPyXzVfSR1t_qxFzwOFhdGY8e3APa6hzY
##
## STATUS AFTER ROTATE
##
Alias:  test_d4eb4a6f
Identifier: EBxFB0RDjcboqnWU_jcEW22lfgYom1oWPX4Unnwyn_j1
Seq No: 1

Witnesses:
Count:          3
Receipts:       3
Threshold:      3

Public Keys:
        1. DIuVROB3izTgPyXzVfSR1t_qxFzwOFhdGY8e3APa6hzY

Note Threshold: 2 before rotation and Threshold: 3 after.

lenkan avatar Apr 16 '25 15:04 lenkan

Yeah, I think toad by default takes on the simple form n of n of the full witness list count. If you don't pass it explicitly this will happen I think. Probably a debate whether to be had to default to the most secure (which I think is the current scheme) or a usable (defaults to last valid threshold).

daidoji avatar Apr 16 '25 16:04 daidoji

If I perform a rotation with the intention of just rotating keys, I do not expect toad to change. To me this is a bug. Otherwise, I believe --toad should be a required argument for kli rotate.

lenkan avatar Apr 23 '25 13:04 lenkan

I think this is a valuable change. It is definitely an oversight (a bug) and should have defaulted to existing threshold if not specified by --toad.

pfeairheller avatar May 09 '25 14:05 pfeairheller