remote_web3signer

README

Web3Signer

Web3Signer is a popular remote signer tool by Consensys to allow users to store validation keys outside the validation client and signed without the vc knowing the private keys. Web3Signer Specs are found by searching Consensys' Web3Signer API specification

issue: https://github.com/prysmaticlabs/prysm/issues/9994

API interface: https://github.com/ethereum/remote-signing-api

Features

CLI

detailed info found on https://docs.prylabs.network/docs/wallet/web3signer

Flags used on validator client

• --validators-external-signer-url=http://localhost:9000

with hex keys

• --validators-external-signer-public-keys=0xa99a...e44c,0xb89b...4a0b

with url

• --validators-external-signer-public-keys=https://web3signer.com/api/v1/eth2/publicKeys

API

• Get Public keys: returns all public keys currently stored with web3signer excluding newly added keys if reload keys was not run.
• Sign: Signs a message with a given public key. There are several types of messages that can be signed ( web3signer type to prysm type):
  • BLOCK <- *validatorpb.SignRequest_Block
  • ATTESTATION <- *validatorpb.SignRequest_AttestationData
  • AGGREGATE_AND_PROOF <- *validatorpb.SignRequest_AggregateAttestationAndProof
  • AGGREGATION_SLOT <- *validatorpb.SignRequest_Slot
  • BLOCK_ALTAIR <- *validatorpb.SignRequest_BlockAltair
  • BLOCK_BELLATRIX <- *validatorpb.SignRequest_BlockBellatrix
  • BLINDED_BLOCK_BELLATRIX <- *validatorpb.SignRequest_BlindedBlockBellatrix
  • DEPOSIT <- not supported
  • RANDAO_REVEAL <- *validatorpb.SignRequest_Epoch
  • VOLUNTARY_EXIT <- *validatorpb.SignRequest_Exit
  • SYNC_COMMITTEE_MESSAGE <- *validatorpb.SignRequest_SyncMessageBlockRoot
  • SYNC_COMMITTEE_SELECTION_PROOF <- *validatorpb.SignRequest_SyncAggregatorSelectionData
  • SYNC_COMMITTEE_CONTRIBUTION_AND_PROOF <- *validatorpb.SignRequest_ContributionAndProof
• Reload Keys: reloads all public keys from the web3signer.
• Get Server Status: returns OK if the web3signer is ok.

Files Added and Files Changed

• Files Added:

  • validator/keymanager/remote-web3signer package

• Files Modified:

  • modified: cmd/validator/flags/flags.go
  • modified: validator/accounts/accounts_backup.go
  • modified: validator/accounts/accounts_list.go
  • modified: validator/accounts/iface/wallet.go
  • modified: validator/accounts/userprompt/prompt.go
  • modified: validator/accounts/wallet/wallet.go
  • modified: validator/accounts/wallet_create.go
  • modified: validator/client/runner.go
  • modified: validator/client/validator.go
  • modified: validator/keymanager/remote-web3signer/keymanager.go
  • modified: validator/keymanager/types.go

Documentation

Index

• func DisplayRemotePublicKeys(validatingPubKeys [][48]byte)
• type Keymanager
  • func NewKeymanager(_ context.Context, cfg *SetupConfig) (*Keymanager, error)
  • func (km *Keymanager) AddPublicKeys(pubKeys []string) []*keymanager.KeyStatus
  • func (km *Keymanager) DeleteKeystores(context.Context, [][]byte) ([]*keymanager.KeyStatus, error)
  • func (km *Keymanager) DeletePublicKeys(pubKeys []string) []*keymanager.KeyStatus
  • func (*Keymanager) ExtractKeystores(_ context.Context, _ []bls.PublicKey, _ string) ([]*keymanager.Keystore, error)
  • func (km *Keymanager) FetchValidatingPublicKeys(ctx context.Context) ([][fieldparams.BLSPubkeyLength]byte, error)
  • func (km *Keymanager) ListKeymanagerAccounts(ctx context.Context, cfg keymanager.ListKeymanagerAccountConfig) error
  • func (km *Keymanager) Sign(ctx context.Context, request *validatorpb.SignRequest) (bls.Signature, error)
  • func (km *Keymanager) SubscribeAccountChanges(pubKeysChan chan [][fieldparams.BLSPubkeyLength]byte) event.Subscription
• type SetupConfig

Functions

func DisplayRemotePublicKeys

func DisplayRemotePublicKeys(validatingPubKeys [][48]byte)

DisplayRemotePublicKeys prints remote public keys to stdout.

Types

type Keymanager

type Keymanager struct {
	// contains filtered or unexported fields
}

Keymanager defines the web3signer keymanager.

func NewKeymanager

func NewKeymanager(_ context.Context, cfg *SetupConfig) (*Keymanager, error)

NewKeymanager instantiates a new web3signer key manager.

func (*Keymanager) AddPublicKeys

func (km *Keymanager) AddPublicKeys(pubKeys []string) []*keymanager.KeyStatus

AddPublicKeys imports a list of public keys into the keymanager for web3signer use. Returns status with message.

func (*Keymanager) DeleteKeystores

func (km *Keymanager) DeleteKeystores(context.Context, [][]byte) ([]*keymanager.KeyStatus, error)

DeleteKeystores is not supported for the remote-web3signer keymanager type.

func (*Keymanager) DeletePublicKeys

func (km *Keymanager) DeletePublicKeys(pubKeys []string) []*keymanager.KeyStatus

DeletePublicKeys removes a list of public keys from the keymanager for web3signer use. Returns status with message.

func (*Keymanager) ExtractKeystores

func (*Keymanager) ExtractKeystores(
	_ context.Context, _ []bls.PublicKey, _ string,
) ([]*keymanager.Keystore, error)

ExtractKeystores is not supported for the remote-web3signer keymanager type.

func (*Keymanager) FetchValidatingPublicKeys

func (km *Keymanager) FetchValidatingPublicKeys(ctx context.Context) ([][fieldparams.BLSPubkeyLength]byte, error)

FetchValidatingPublicKeys fetches the validating public keys from the remote server or from the provided keys if there are no existing public keys set or provides the existing keys in the keymanager.

func (*Keymanager) ListKeymanagerAccounts

func (km *Keymanager) ListKeymanagerAccounts(ctx context.Context, cfg keymanager.ListKeymanagerAccountConfig) error

func (*Keymanager) Sign

func (km *Keymanager) Sign(ctx context.Context, request *validatorpb.SignRequest) (bls.Signature, error)

Sign signs the message by using a remote web3signer server.

func (*Keymanager) SubscribeAccountChanges

func (km *Keymanager) SubscribeAccountChanges(pubKeysChan chan [][fieldparams.BLSPubkeyLength]byte) event.Subscription

SubscribeAccountChanges returns the event subscription for changes to public keys.

type SetupConfig

type SetupConfig struct {
	BaseEndpoint          string
	GenesisValidatorsRoot []byte

	// Either URL or keylist must be set.
	// If the URL is set, the keymanager will fetch the public keys from the URL.
	// caution: this option is susceptible to slashing if the web3signer's validator keys are shared across validators
	PublicKeysURL string

	// Either URL or keylist must be set.
	// a static list of public keys to be passed by the user to determine what accounts should sign.
	// This will provide a layer of safety against slashing if the web3signer is shared across validators.
	ProvidedPublicKeys [][48]byte
}

SetupConfig includes configuration values for initializing. a keymanager, such as passwords, the wallet, and more. Web3Signer contains one public keys option. Either through a URL or a static key list.