The keys of a node

A ZooBC node operator uses two keys. The node key is the machine's identity: it lives on the node and signs what the node does all day. The owner key is an ordinary account in the operator's wallet: it controls the seat and the stake. Keeping them apart means that a break-in on the server does not hand over the operator's wallet.

The node key

The node key is a 32-byte Ed25519 key, written with the prefix ZNK_. It is kept in the node's configuration file, node.conf, and it signs:

• the blocks the node makes, and the proof behind each block's seed (block seed (VRF));
• receipts for the blocks and transactions it receives from its peers (receipts and the network topology);
• messages to its peers, including the handshake that opens each connection;
• its signatures on the spine chain;
• attestations and votes, such as price votes and release vetoes;
• proofs that it holds pieces of the decentralised storage (decentralised storage pool).

Because node.conf holds the private key, the node refuses to start if other users on the machine can read the file; when the node owns the file, it sets the file's mode to 0600 itself.

The node's own account

The same 32 bytes written with the prefix ZBC_ are an ordinary account: the node's own account. It sends the node's duty transactions, such as storage proofs, attestations and votes, with a fee of exactly 0 (fees). Each genesis seat starts with 10 ZBC on it.

The two texts of one key share the first 51 characters after the prefix and differ only in the last five, because the 3-byte checksum at the end also covers the prefix. Swapping ZNK for ZBC by hand therefore breaks the checksum, and the edited text is refused (accounts and addresses).

The owner key

The owner key is an ordinary ZBC_ account in the operator's wallet. It signs the registry transactions:

• NodeRegistration (type 2), which registers the node and locks its stake;
• a raise of the stake;
• NodeRegistrationUpdate (type 258), which moves the seat to a new node key;
• RemoveNodeRegistration (type 514), which removes the node;
• ClaimNodeRegistration (type 770), which claims the stake.

The stake comes from this account, and the node's lottery winnings are paid back to it. A node never holds its owner's key.

Tied together: the proof of ownership

A registration needs both keys. The node key signs a short message naming the owner's account and a recent block, and the owner key signs the transaction that carries it. Neither key alone can register the pair, and nobody can register someone else's node under their own account. The same proof is required to raise the stake and to claim it. Its exact layout is in registering a node.

Operators create both keys themselves. Nothing is issued, and no one else holds a copy.

Moving the seat to a new node key

If a node key is exposed, or the machine is replaced, the owner can move the seat to a new node key without registering again. NodeRegistrationUpdate carries the new 32-byte key, with a proof of ownership signed by the new key. The node keeps its id, its score, its queue state and its admission. The change takes effect 120 blocks (30 minutes) after the block that includes it.

The node key can also move the stake

Guard the node key as carefully as a wallet key. Whoever holds it can claim the seat's stake to an account they control with ClaimNodeRegistration. The owner's own claim takes effect at once. Anyone else's claim is announced and executes 40,320 blocks (7 days) later, unless the owner removes the node first, so an owner who watches the chain has a week to react (leaving the registry). This is also the path for an owner who has lost access to the owner account: the claim then comes from another account, so it too executes 7 days later.

Other keys

Native keys can be derived from a recovery phrase along m/44'/883'/n', and the same 32-byte key can also be written as a relay key (ZBR_) or a gateway key (ZBG_) (keys and account types). The protocol's four role keys (release authority, page authority, treasury and market maker) are separate keys on separate devices (ZooBC Foundation); an operator needs none of them.

See also

• Registering a node
• Leaving the registry
• Keys and account types
• Accounts and addresses
• Chain-bound signatures