validator-keys-tool
validator-keys-tool copied to clipboard
Add support for external signing
This change, if merged, adds support for external signing tools, such as an HSM (Hardware Security Module).
Additionally:
- Include unit tests for external signing support functions
- Because this is a significant change, and this project is not updated often, increment the version number
- Resolves #48
Outline of steps to use this new functionality:
One-time setup
- Obtain the public key of the external tool, it can be encoded in the
rippledformat (e.g.nHBQi...), hex encoded, or base-64 encoded. Either way, the key must be 33 bytes decoded, and the first byte must be0xEDfor aned25519key, and0x02or0x03for asecp256k1key. - Run
validator-keys create_external <encoded_public_key>
Usage
- Run
validator-keys start_token. This will return a hex encoded string to sign. - Sign the string from step 3 using the external tool. The resulting signature must be hex encoded or base-64 encoded.
- Run
validator-keys finish_token <encoded_signature> - The result will be a token that can be copied to your
rippled.cfgfile just as if it was generated withcreate_token.
The steps to revoke a key are identical to the Usage steps, except using the start_revoke_keys and finish_revoke_keys commands.
For testing, if you don't have an HSM handy, you can accomplish the same thing in Usage step 2 using validator-keys --keyfile <path to a key file generated with create_keys> sign_hex <partial token output from Usage step 1>