validator-keys-tool icon indicating copy to clipboard operation
validator-keys-tool copied to clipboard

Add support for external signing

Open ximinez opened this issue 1 year ago • 0 comments

This change, if merged, adds support for external signing tools, such as an HSM (Hardware Security Module).

Additionally:

  • Include unit tests for external signing support functions
  • Because this is a significant change, and this project is not updated often, increment the version number
  • Resolves #48

Outline of steps to use this new functionality:

One-time setup

  1. Obtain the public key of the external tool, it can be encoded in the rippled format (e.g. nHBQi...), hex encoded, or base-64 encoded. Either way, the key must be 33 bytes decoded, and the first byte must be 0xED for an ed25519 key, and 0x02 or 0x03 for a secp256k1 key.
  2. Run validator-keys create_external <encoded_public_key>

Usage

  1. Run validator-keys start_token. This will return a hex encoded string to sign.
  2. Sign the string from step 3 using the external tool. The resulting signature must be hex encoded or base-64 encoded.
  3. Run validator-keys finish_token <encoded_signature>
  4. The result will be a token that can be copied to your rippled.cfg file just as if it was generated with create_token.

The steps to revoke a key are identical to the Usage steps, except using the start_revoke_keys and finish_revoke_keys commands.

For testing, if you don't have an HSM handy, you can accomplish the same thing in Usage step 2 using validator-keys --keyfile <path to a key file generated with create_keys> sign_hex <partial token output from Usage step 1>

ximinez avatar Apr 09 '24 21:04 ximinez