Skip to content

Commit 680903b

Browse files
0xLucca0xLucca
committed
Add chainspec keys
1 parent 4fd3c2f commit 680903b

File tree

2 files changed

+158
-1
lines changed

2 files changed

+158
-1
lines changed

‎develop/parachains/deployment/generate-chain-specs.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,83 @@ After the conversion to the raw format, the `sudo key` snippet looks like this:
124124

125125
The raw chain specification can be used to initialize the genesis storage for a node.
126126

127+
## Generate Custom Keys for Your Collator
128+
129+
To securely deploy your parachain, you must generate custom cryptographic keys for your collators (block producers). Each collator requires two distinct sets of keys with different security requirements and operational purposes.
130+
131+
- **Account keys** - serve as the primary identity and financial controller for your collator. These keys are used to interact with the network and manage funds. They should be treated as cold storage and must never exist on the filesystem of the collator node. Secure offline backup is essential
132+
133+
- **Session keys** - handle block production operations to identify your node and sign blocks on the network. These keys are stored in the parachain keystore and function as operational "hot wallet" keys. If compromised, an attacker could impersonate your node, potentially resulting in slashing of your funds. To minimize these risks, implement regular session key rotation and treat them with the same caution as hot wallet keys
134+
135+
To perform this step, you can use [subkey](https://docs.rs/crate/subkey/latest){target=\_blank}, a command-line tool for generating and managing keys:
136+
137+
```bash
138+
docker run -it parity/subkey:latest generate --scheme sr25519
139+
```
140+
141+
The output should look similar to the following:
142+
143+
--8<-- 'code/tutorials/polkadot-sdk/parachains/zero-to-hero/deploy-to-testnet/key.html'
144+
145+
Ensure that this command is executed twice to generate the keys for both the account and session keys. Save them for future reference.
146+
147+
After generating the plain chain specification, you need to edit this file by inserting the account IDs and session keys in SS58 format generated for your collators in the `collatorSelection.invulnerables` and `session.keys` fields
148+
149+
### Add Invulnerables
150+
151+
In the `collatorSelection.invulnerables` array, add the SS58 addresses (account keys) of your collators. These addresses will be automatically included in the active collator set:
152+
153+
```json
154+
"collatorSelection": {
155+
"candidacyBond": 16000000000,
156+
"desiredCandidates": 0,
157+
"invulnerables": [
158+
"INSERT_ACCOUNT_ID_COLLATOR_1",
159+
"INSERT_ACCOUNT_ID_COLLATOR_2",
160+
"INSERT_ACCOUNT_ID_COLLATOR_3"
161+
]
162+
}
163+
```
164+
165+
- **candidacyBond**: Minimum stake required for collator candidates (in planck units)
166+
167+
- **desiredCandidates**: Number of candidates beyond invulnerables (set to 0 for invulnerables-only)
168+
169+
- **invulnerables**: Use the SS58 addresses from your generated account keys as collators
170+
171+
### Add Session Keys
172+
173+
For each invulnerable collator, add a corresponding entry in the `session.keys` array. This maps each collator's account ID to their session keys:
174+
175+
```json
176+
"session": {
177+
"keys": [
178+
[
179+
"INSERT_ACCOUNT_ID_COLLATOR_1",
180+
"INSERT_ACCOUNT_ID_COLLATOR_1",
181+
{
182+
"aura": "INSERT_SESSION_KEY_COLLATOR_1"
183+
}
184+
],
185+
[
186+
"INSERT_ACCOUNT_ID_COLLATOR_2",
187+
"INSERT_ACCOUNT_ID_COLLATOR_2",
188+
{
189+
"aura": "INSERT_SESSION_KEY_COLLATOR_2"
190+
}
191+
],
192+
[
193+
"INSERT_ACCOUNT_ID_COLLATOR_3",
194+
"INSERT_ACCOUNT_ID_COLLATOR_3",
195+
{
196+
"aura": "INSERT_SESSION_KEY_COLLATOR_3"
197+
}
198+
]
199+
],
200+
"nonAuthorityKeys": []
201+
}
202+
```
203+
127204
## Where to Go Next
128205

129206
After generating a chain specification, you can use it to initialize the genesis storage for a node. Refer to the following guides to learn how to proceed with the deployment of your blockchain:

‎llms.txt‎

Lines changed: 81 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4436,6 +4436,86 @@ After the conversion to the raw format, the `sudo key` snippet looks like this:
44364436

44374437
The raw chain specification can be used to initialize the genesis storage for a node.
44384438

4439+
## Generate Custom Keys for Your Collator
4440+
4441+
To securely deploy your parachain, you must generate custom cryptographic keys for your collators (block producers). Each collator requires two distinct sets of keys with different security requirements and operational purposes.
4442+
4443+
- **Account keys** - serve as the primary identity and financial controller for your collator. These keys are used to interact with the network and manage funds. They should be treated as cold storage and must never exist on the filesystem of the collator node. Secure offline backup is essential
4444+
4445+
- **Session keys** - handle block production operations to identify your node and sign blocks on the network. These keys are stored in the parachain keystore and function as operational "hot wallet" keys. If compromised, an attacker could impersonate your node, potentially resulting in slashing of your funds. To minimize these risks, implement regular session key rotation and treat them with the same caution as hot wallet keys
4446+
4447+
To perform this step, you can use [subkey](https://docs.rs/crate/subkey/latest){target=\_blank}, a command-line tool for generating and managing keys:
4448+
4449+
```bash
4450+
docker run -it parity/subkey:latest generate --scheme sr25519
4451+
```
4452+
4453+
The output should look similar to the following:
4454+
4455+
<div id="termynal" data-termynal>
4456+
<span data-ty="input"><span class="file-path"></span>docker run -it parity/subkey:latest generate --scheme sr25519</span>
4457+
<span> <br />Secret phrase: lemon play remain picture leopard frog mad bridge hire hazard best buddy <br />Network ID: substrate <br />Secret seed: 0xb748b501de061bae1fcab1c0b814255979d74d9637b84e06414a57a1a149c004 <br />Public key (hex): 0xf4ec62ec6e70a3c0f8dcbe0531e2b1b8916cf16d30635bbe9232f6ed3f0bf422 <br />Account ID: 0xf4ec62ec6e70a3c0f8dcbe0531e2b1b8916cf16d30635bbe9232f6ed3f0bf422 <br />Public key (SS58): 5HbqmBBJ5ALUzho7tw1k1jEgKBJM7dNsQwrtfSfUskT1a3oe <br />SS58 Address: 5HbqmBBJ5ALUzho7tw1k1jEgKBJM7dNsQwrtfSfUskT1a3oe </span>
4458+
</div>
4459+
4460+
Ensure that this command is executed twice to generate the keys for both the account and session keys. Save them for future reference.
4461+
4462+
After generating the plain chain specification, you need to edit this file by inserting the account IDs and session keys in SS58 format generated for your collators in the `collatorSelection.invulnerables` and `session.keys` fields
4463+
4464+
### Add Invulnerables
4465+
4466+
In the `collatorSelection.invulnerables` array, add the SS58 addresses (account keys) of your collators. These addresses will be automatically included in the active collator set:
4467+
4468+
```json
4469+
"collatorSelection": {
4470+
"candidacyBond": 16000000000,
4471+
"desiredCandidates": 0,
4472+
"invulnerables": [
4473+
"INSERT_ACCOUNT_ID_COLLATOR_1",
4474+
"INSERT_ACCOUNT_ID_COLLATOR_2",
4475+
"INSERT_ACCOUNT_ID_COLLATOR_3"
4476+
]
4477+
}
4478+
```
4479+
4480+
- **candidacyBond**: Minimum stake required for collator candidates (in planck units)
4481+
4482+
- **desiredCandidates**: Number of candidates beyond invulnerables (set to 0 for invulnerables-only)
4483+
4484+
- **invulnerables**: Use the SS58 addresses from your generated account keys as collators
4485+
4486+
### Add Session Keys
4487+
4488+
For each invulnerable collator, add a corresponding entry in the `session.keys` array. This maps each collator's account ID to their session keys:
4489+
4490+
```json
4491+
"session": {
4492+
"keys": [
4493+
[
4494+
"INSERT_ACCOUNT_ID_COLLATOR_1",
4495+
"INSERT_ACCOUNT_ID_COLLATOR_1",
4496+
{
4497+
"aura": "INSERT_SESSION_KEY_COLLATOR_1"
4498+
}
4499+
],
4500+
[
4501+
"INSERT_ACCOUNT_ID_COLLATOR_2",
4502+
"INSERT_ACCOUNT_ID_COLLATOR_2",
4503+
{
4504+
"aura": "INSERT_SESSION_KEY_COLLATOR_2"
4505+
}
4506+
],
4507+
[
4508+
"INSERT_ACCOUNT_ID_COLLATOR_3",
4509+
"INSERT_ACCOUNT_ID_COLLATOR_3",
4510+
{
4511+
"aura": "INSERT_SESSION_KEY_COLLATOR_3"
4512+
}
4513+
]
4514+
],
4515+
"nonAuthorityKeys": []
4516+
}
4517+
```
4518+
44394519
## Where to Go Next
44404520

44414521
After generating a chain specification, you can use it to initialize the genesis storage for a node. Refer to the following guides to learn how to proceed with the deployment of your blockchain:
@@ -14232,7 +14312,7 @@ In this unit file, you will write the commands that you want to run on server bo
1423214312
[Unit]
1423314313
Description=Polkadot Node
1423414314
After=network.target
14235-
Documentation=https://github.com/paritytech/polkadot
14315+
Documentation=https://github.com/paritytech/polkadot-sdk
1423614316

1423714317
[Service]
1423814318
EnvironmentFile=-/etc/default/polkadot

0 commit comments

Comments
 (0)