Popular Science: How Eth2 Validators Generate and Protect Withdrawal Keys
Editor's Note: This article comes fromEthereum enthusiasts (ID: ethfans)Ethereum enthusiasts (ID: ethfans)
Ethereum enthusiasts (ID: ethfans)
, Author: Jim McDonald, Translator & Proofreader: Elisa & Min Min, reproduced by Odaily with authorization.
first level title
Withdrawal key (withdrawal key) is the key 1 used by validators in Ethereum 2.0 to withdraw Ethereum.
The keys of Ethereum 2.0 and the keys of Ethereum 1.0 are generated and used in roughly the same way, but the two are not compatible, that is, the keys generated on Ethereum 1.0 cannot be used on Ethereum 2.0.
Keys in Ethereum 2.0 always appear in pairs in the form of a public key and a private key. Withdrawal keys are held by the stakers themselves, because they are the providers of funds and of course want to retain the right to withdraw funds.
What is the withdrawal key used for?
In Ethereum 2.0, the withdrawal key information is mainly used in the following two situations: creating a deposit deposit transaction in Ethereum 1.0; withdrawing Ethereum in Ethereum 2.0.
When a user deposits a deposit on Ethereum 1.0, the function of the withdrawal public key is to associate the deposit with the withdrawal private key. This is why Ethereum 2.0 can know who has the right to withdraw through the withdrawal public key (the withdrawal private key corresponding to the withdrawal public key has the right to withdraw the deposit). The withdrawal public key is also used to integrate the data into the Ethereum deposit transaction, as shown in the following diagram:
- Figure 1: Using the withdrawal public key in the deposit process (for details, please refer to this article) (Editor's note: see the hyperlink at the end of the article "Verifier's Life Process")-
One thing to note is that the withdrawal public key 2 is used in every deposit agreement.
The details of the withdrawal of Ethereum on Ethereum 2.0 have not yet been determined, but no matter what method is adopted in the future, the withdrawal private key is required to sign and authorize.
image description
In the example above, the stakeholder uses the withdrawal private key to sign the details of the withdrawal operation. Then, the Ethereum 2.0 network can compare the signature authorization in the withdrawal operation with the withdrawal identification in the deposit agreement (as shown in Figure 1). If the two match, the withdrawal operation can proceed.
We do not need to use the withdrawal private key until the withdrawal function is available. The withdrawal function may not be available for more than one year after depositing the deposit. Even when a feature is available, it doesn't have to be used. For those stakeholders who want to receive rewards in the long term, the ability to withdraw funds has little impact on their daily operations.
This means that we should protect our private withdrawal key so that we don't need to use it in the short term, even if we only need to use it occasionally in the long run. In other words, when balancing the security and usability of keys, security should be our priority.
first level title
How many private keys should be protected?
Another question that needs to be answered is: How many private keys do we need to protect in total?
The second reason is that using the same private key makes the value of the private key too high, making it easier to steal. However, storing different private keys in the same place can cause the same problem. That is to say, different private keys should be physically and logically separated to reduce the impact of loss.
step
In short, if you want to prevent others from discovering the same entity behind multiple validator identities (assuming each of your deposits comes from a different Ethereum 1.0 address), and store each of your withdrawal private keys separately , or adopt different key protection mechanisms, then using multiple private keys will bring substantial benefits. Since ordinary users generally do not do this, the rest of this article only introduces how to use a single withdrawal private key. If necessary, the content of this article will also apply to the situation of holding multiple private keys.
first level title
step
Now that we know the basic requirements, let's look at how to create and secure a withdrawal key. The steps to create a new key are as follows:
Create a withdrawal wallet;
Create a withdrawal account;
Delete withdrawal wallet;
Confirm withdrawal wallet can be restored.
image description
- Figure 3: Steps to create and secure withdrawal keys -
These steps must be completed on a computer, be careful to prevent computer intrusion. The length of this article is limited, and we will not discuss how to prevent computer from being hacked, but the user must at least do one thing: the computer cannot be connected to the Internet when performing the above process.
secondary title
ethdo wallet create --wallet="Staking wallet" --type=hd --walletpassphrase=secret1
Create withdrawal wallet
At the time of writing this article, no Ethereum 2.0 key hardware wallet based on the BLS12-381 curve has been developed. up). Therefore, the keys must be generated in software. This article uses the ethdo command-line tool as an example, you can also use other tools to achieve it.
This line of code creates a wallet with a mnemonic phrase. The mnemonic consists of 24 words and can be used to restore previously created wallets and all accounts within the wallet and should be secured immediately. The above command will output the mnemonic, which should be saved offline. If the mnemonic is not displayed after entering the command, the wallet cannot be restored, then we should not use this wallet.
There are many ways to save your mnemonic, such as Blockplate and Cryptosteel, but you can also copy it down and keep it in a safe (preferably fireproof) place. Remember, once the seed phrase is lost, you will not be able to withdraw funds, so take appropriate steps to keep it safe.
After the mnemonic is saved, we can start to create a withdrawal account.
ethdo account create --account="Staking wallet/Withdrawal account" --walletpassphrase=secret1 --passphrase=secret2
Create withdrawal account
The command to create a withdrawal account is as follows:
The wallet password (walletpassphrase) must be the same as the password you provided in the previous section. The latter password is only the password of this account and is only used temporarily before deleting the account.
ethdo account info --account="Staking wallet/Withdrawal account"
secondary title
As the name implies, the public key is public and requires no special security measures. Run the following code to view the public key:
If the code does not output the withdrawal public key, it may indicate an error in the account creation process. Carefully review the code that was previously run for errors.
Note that while public keys are not private, reasonable steps should be taken to ensure that malicious attackers cannot exchange your public key for theirs.
ethdo wallet delete --wallet="Staking wallet"
secondary title
ethdo wallet info --wallet="Staking wallet"
If the above steps are performed correctly, we can safely delete the withdrawal wallet. Please run the code below:
Then, you can run the following code to access the wallet to confirm whether the wallet has been deleted:
Normally, an error message is returned because the wallet cannot be found.
secondary title
ethdo wallet create --wallet="Recovery wallet" --type=hd --walletpassphrase=temp1 --mnemonic="MNEMONIC"
Confirm withdrawal wallet can be restored
It is best to rebuild the withdrawal wallet before making any deposits with the withdrawal key. Not only does this ensure we are familiar with the process, but it also provides a final check for possible errors before you deposit your funds.
ethdo account create --account="Recovery wallet/Withdrawal account" --walletpassphrase=temp1 --passphrase=temp2
The first thing to do is to rebuild the wallet with the mnemonic. Please run the code below:
ethdo account info --account="Recovery wallet/Withdrawal account"
Replace mnemonic in the code above with your mnemonic.
Then run the following code to rebuild the withdrawal account:
ethdo wallet delete --wallet="Recovery wallet"
Run the following code to get its public key:
ethdo wallet info --wallet="Recovery wallet"
To delete the wallet again, run the code below:
Then run the following code to try to access the wallet to confirm whether it has been deleted:
Can the above steps also be used for validator keys?
footnote
Can't. Ethereum 2.0 validator keys and withdrawal keys are used very differently, and are different from most keys you are familiar with. We will detail validator keys, their usage and protection in the next article.
secondary title
footnote
