xrpl-dev-portal icon indicating copy to clipboard operation
xrpl-dev-portal copied to clipboard

Tutorial: what to do if your XRP Ledger keys are compromised

Open mDuo13 opened this issue 3 years ago • 0 comments

Tutorial walking you through what steps you can possibly do. Should cover the immediate "how do I get control back" response for the following cases:

  • Your master private key has been compromised or may have been compromised
    • set a regular key pair, disable the master key, move the XRP to another account
    • if the malicious actor does this first, you're screwed
  • Your regular private key has been compromised
    • set a a new regular key, using the free "key reset transaction" if necessary
    • you might need to send, say, 1 drop of XRP first to get your lsfPasswordSpent flag disabled.
  • A key in your signer list has been compromised
    • Depending on the quorum in your signer list, the severity of this can vary. Research needed into how to break down cases and how to respond to each case.

Should also cover the, "OK, I got control back, now what?" steps, such as:

  • check your transaction history to see if the account changed any settings or relationships while you were compromised
  • migrate to a new account in case any settings or relationships were irrevocably altered (e.g. issuing more currency)

And also optionally the painful "I couldn't get control back, what now?" migration.

For the issuing gateway use case and to a lesser extent the exchange case, much of this is documented in Ripple's old, proprietary Key Lifecycle Management guide, which can probably be open-sourced and used as a basis for this task. No existing docs are targeted at the individual trader case though.

mDuo13 avatar Apr 07 '21 09:04 mDuo13