Validator Key Management & Hardware Security

When running a validator node on the Dime network, key management is the single most critical operational responsibility. A compromised key can lead to lost delegation stakes, malicious block production, or total loss of accumulated commission.

In this guide, we break down the four essential keypair roles, explain how to isolate them across different physical security tiers, and outline best practices for cold signing.

The Four Essential Validator Key Roles

Unlike simpler blockchain protocols where a single private key controls all node operations and fund balances, Dime enforces a granular separation of concerns:

+-------------------------------------------------------------------------+
|                         VALIDATOR KEY ARCHITECTURE                      |
+-------------------------------------------------------------------------+
  |
  +---> 1. IDENTITY KEYPAIR (Hot / Server Level)
  |      Identifies node on gossip network, signs block proposals
  |
  +---> 2. VOTE KEYPAIR (Hot or Remote Signer)
  |      Signs consensus votes for each slot hash
  |
  +---> 3. VOTE AUTHORITY KEYPAIR (Warm / Cold Storage)
  |      Authorizes changes to validator commission rate & vote account
  |
  +---> 4. AUTHORIZED WITHDRAWER (Cold / Air-Gapped / Ledger)
         Ultimate root authority capable of withdrawing staking rewards

1. Identity Keypair (Validator Identity)

Role: Represents the node’s public IP and identity in the cluster’s gossip directory. Used to sign shreds during slot leadership and pay transaction fees for outbound vote transactions.
Exposure: Stored directly on the live validator server filesystem (/home/validator/validator-keypair.json).
Security Posture: While hot, this keypair should hold only a minimal operating balance (e.g., 5 to 10 tokens) strictly for paying vote transaction network fees.

2. Vote Keypair & Vote Account

Role: Holds the public state of the validator’s historical consensus votes, accumulated commission credits, and delegator associations.
Exposure: The vote account is an on-chain program account. The private key used to sign active votes is loaded into the validator’s daemon or held by a dedicated Hardware Security Module (HSM) signing proxy.

3. Authorized Withdrawer Key (The Ultimate Root Authority)

Role: The Authorized Withdrawer has sovereign authority to withdraw accumulated commission rewards from the vote account or change the vote authority key.
Exposure: MUST NEVER BE STORED ON THE LIVE VALIDATOR SERVER.
Security Posture: This keypair must be generated on an air-gapped machine or managed via a hardware ledger device (such as a Ledger Nano or Trezor). The private key or seed phrase should be stored in a physical fireproof safe in offline tamper-evident envelopes.

Air-Gapped Key Generation Workflow

To generate your root withdrawal authority and vote authority keys securely, follow this air-gapped procedure:

Prepare an Offline Workstation: Boot an air-gapped laptop using a live Linux USB distribution (e.g., Ubuntu Live or Tails) with all networking interfaces (Wi-Fi, Bluetooth, Ethernet) physically disabled.

Generate Keypair with Strong Entropy:

# Generate air-gapped root withdrawer keypair
dime-keygen new --no-passphrase --outfile withdrawer-keypair.json --word-count 24

Record Seed Phrase Physically: Write down the 24-word recovery phrase on archival paper or stamp it into stainless steel plates.
Extract Public Key Only: Export only the public key to a clean, formatted USB stick for broadcasting to the live node:
```
dime-keygen pubkey withdrawer-keypair.json > withdrawer-pubkey.txt
```
Securely Wipe RAM: Power off the air-gapped machine to purge volatile memory before reconnecting any media.

Remote Signer Daemons & Double-Signer Protection

For institutional operations running high-availability clusters, using a remote signing daemon provides an additional layer of isolation:

The validator server does not store the vote private key in RAM.
When a vote must be signed, a cryptographic payload is transmitted over an encrypted, authenticated internal VPC connection to a dedicated signing enclave.
The signing enclave verifies that the slot height is strictly greater than the previously signed slot before generating the Ed25519 signature, rendering double-signing programmatically impossible.