Key Management
Create, encrypt and manage private keys using the Othentic CLI
Overview
The Othentic Stack provides various methods for managing and using keys. Operators can interact with the CLI using either raw keys or encrypted Keystore files, which offer an additional layer of security.
AVSs are networks that rely on continuous off-chain execution logic, with tasks ultimately settled on-chain. This requires automated signing, where operators submit transactions to AVS contracts while also engaging in peer-to-peer consensus.
Using the same key for both AVS registration and consensus introduces a security vulnerability, as the key must be stored on the task-performing machine in a potentially insecure format—either as raw text or within an encrypted Keystore file.
Depending on security requirements, Operators can either use a single key for all AVS operations or separate them into a Controller Key and a Consensus Key.
Key Roles and Separation
When registering as an Operator using the CLI, users are required to provide both keys separately.
Although the same key can be used for both the Controller and Consensus roles, it is strongly recommended to use encrypted Keystore files for enhanced security.
Controller Key
The Controller Key is used as an ECDSA key for the following purposes:
Register as Operator in Eigenlayer contracts.
Interact with the AVS as Operator:
Register as Operator in AVSGovernance contract.
Submit proof-of-tasks to AttestationCenter contract.
Request rewards from AttestationCenter contract.
Submit task aggregation result to AttestationCenter contract.
Consensus Key
The Consensus Key is used exclusively as a BLS key for:
Attesting task validity or invalidity in the P2P networking layer.
Generating Keystore-Encrypted Keys
The othentic-cli
simplifies key generation and encryption into Keystore files. If you already have raw keys generated using another tool, these can also be used directly in either raw format or as Keystore files.
To generate a new set of keystore-encrypted keys, use the command:
PRIVATE_KEY
: A raw 32-byte private key to encrypt as keystore. If not supplied, CLI will auto-generate a new private key and proceed to encrypt it.KEYSTORE_PATH
: Path to the JSON-formatted Keystore file. If not supplied, a UUID-based filename will be auto-generated and saved under the.keystore
directory.
Using Separate Controller and Consensus Keys
To leverage key separation for increased security, follow these steps:
Generate keys twice using the
othentic-cli wallet encrypt
command (as detailed above)Optionally, name the Controller key
controller.json
and the Consensus keyconsensus.json
Register as Operator for the AVS.
Store the Controller key securely.
Use Consensus key on the machine(s) running the node software. Configure the env variables by setting the
PRIVATE_KEY
to the Consensus Key and theOPERATOR_ADDRESS
to the public address of the Controller Key.
Key Usage in CLI
Keys can be provided either at runtime or through environment variables.
Using Keystore files
At Runtime:
KEYSTORE_PATH
: Path to the JSON-formatted Keystore file.DECRYPT_PASSWORD
: Password to decrypt the Keystore file. If not supplied, you will be prompted to enter it at runtime.
Using Environment Variables:
In your .env
file:
Using Raw Keys
At Runtime:
Example:
Using Environment Variables
Last updated