¿El uso de un firmante remoto o un libro mayor realmente mejora la seguridad?

Question

¿El uso de un firmante remoto o un libro mayor realmente mejora la seguridad?

- 2
- 147 2019-04-04
TL; DR El uso de unfirmante remoto o un libromayor hace ungrantrabajoparaproteger las claves secretas. Peronoprotege contrael retiro de XTZ de las cuentas. Cualquiera que obtenga acceso alpanaderopuede retirarfondos usando un simple comandotezos-client. ¿Esesto correcto?

Pensé queteníatodoesto resuelto ytenía una sensación acogedora de quemispequeñostezzies durmieran segurospor lanoche. Pero ahoraestoy cuestionandotodo lo que he hechopara asegurarlos. Hice una pregunta sobre seguridad con horneadoen solitario hace unmes o dos y ahora ha vueltoparaperseguirme.

Resumen rápido:

Tengo unpanadero con unmínimo de XTZpara cubrir los depósitos. Tengo una dirección KT1 originada que creé apartir de una direcciónimplícita de Ledger TZ1. Lamayoría demis XTZ son razonablemente seguros.

Sinembargo,paraprotegermi XTZ depanadería,decidí configurar unfirmante remotoen una caja diferente ymuy aislada. Atodos losefectosprácticos,solomi nodo Tezospuede comunicarse con él através de una redprivada.

Como señaló Lukeen mipregunta anterior vinculada anteriormente,y lo quenoentendí completamenteen esemomentofue:

Dado queelfirmantenotiene autenticación,cualquiera quepuedainiciar sesión su sistema de horneado de algunamanerapuedefirmarmensajes conelfirmante remoto, incluida latransferencia del saldo de sufianza/depósito.

Ahoraentiendo completamente lo que quiso decir. Entonces,¿cuáleselpunto detener unfirmante remoto dadoesteproblema?

Incluso siestuviera usando un libromayor,¿elproblemano seríaelmismo? Sipudiera acceder al sistema de horneado,podría retirar dinero de la cuenta.

Tantoen escenarios defirma remota como de libromayor,parece queprotegemos las claves,permanecen seguras,peroel XTZ aún sepuedetransferir ynoes seguro.

Si queremos automatizarel horneado (firma remota o libromayor),debemos configurar las cosas deestamanera. Nopodemos sentarnos alrededor denuestras computadorastodoel díae ingresar la contraseña cuando senos solicite.

¿Quéme estoyperdiendo aquí?

TL;DR Using a remote signer or a ledger does a great job at protecting secret keys. But it doesn't protect against the withdrawal of XTZ from accounts. Anyone that gains access to the baker can withdraw funds from it using a simple tezos-client command. Is this correct?

I thought I had this all figured out and had a cozy feeling of my little tezzies sleeping securely at night. But now I'm questioning everything I've done to secure them. I asked a question about security with solo baking a month or two ago and it has now come back to haunt me.

Quick summary:

I have a baker with just a minimum of XTZ to cover deposits. I have an originated KT1 address I created from a Ledger TZ1 implicit address. The majority of my XTZ are reasonably secure.

However, to protect my baker's XTZ, I decided to setup a remote signer on a different, very isolated box. For all practical purposes only my Tezos Node can talk to it via a private network.

As Luke pointed out in my earlier question linked to above, and what I didn't fully understand at the time was:

Because the signer has no authentication, anyone that can login to your baking system somehow can sign messages with the remote signer, including balance transfer of your bond/deposit.

Now I fully understand what he meant. So what's the point of having a remote-signer given this problem?

Even if I was using a ledger, wouldn't the problem still be the same? If I could get access to the baking system, I could withdrawal money from the account.

In both remote-signer and ledger scenarios, it seems we protect the keys -- they stay safe -- but the XTZ can still be transferred out and is not safe.

If we want to automate baking (remote-signer or ledger), we need to set things up this way. We can't sit around our computers all day and enter the password when prompted.

What am I missing here?

baking ledger remote-signer

1 respuesta

votos

Tom · Accepted Answer · 2019-04-05

6

2019-04-05

tezos-signer admite las opciones --require-authentication,--magic-bytes y --check-high-watermark. Debería comprenderlos.

 $ tezos-signer man -v 3
...
  -A --require-authentication: Require a signature from the caller to sign.
...
    -M --magic-bytes <0xHH,0xHH,...>: values allowed for the magic bytes, defaults to any
    -W --check-high-watermark: high watermark restriction
      Stores the highest level signed for blocks and endorsements for each
      address, and forbids to sign a level that is inferior or equal
      afterwards, except for the exact same input data.
...
  add authorized key <pk> [-N --name <name>]
    Authorize a given public key to perform signing requests.
    <pk>: full public key (Base58 encoded)
    -N --name <name>: an optional name for the key (defaults to the hash)

La aplicaciónpara hornear Ledger de Obsidian validaelbytemágico,permitiendo solo 0x01 y 0x02,que se utilizanparabloques yendosos (respectivamente). Puedeencontrarestosbytesmágicosen mlnorener/a>. Elbytemágico "Generic_operation" 0x03 se utilizaparatodas las demás operacionesfirmadas definidasporelprotocolo:transferencias,originaciones,delegación,votación,etc.

La aplicaciónpara horneartambiénmantiene unnivel demarca de agua altoparaevitar duplicaciones. Solo deberíapoderestropearesto con set ledger high watermark (con confirmaciónen el dispositivo),durante las actualizaciones de la aplicación de horneado (queborranel HWM) o utilizando varios Ledgerspara lamisma clave.

Sielfirmante detezoses seguro yfunciona según loprevisto,y usas almenos --magic-bytes y --check-high-watermark correctamente,entonces deberíafuncionarmás omenos como la aplicación Ledger: alguien que obtenga accesonormal solo deberíapoderfirmarbloques yendosos,sin causar duplicaciones.

Eso aúnpodría sermaloparati,porquepodríasperderbloqueos/respaldos yperder recompensas. Puede quetambién seamalopor otras razones ... ¡Perono setrata defirmartransferencias!

Usar --require-authenticationprobablemente sea unabuenaidea,pero volveremos atenerelmismoproblema. El cliente (porejemplo,panadero) que utiliza unfirmante remoto con autenticación debepoderfirmartodas las solicitudes alfirmante con una clave autorizada,ytendremos lasmismaspreguntas sobre la seguridad deesta clave autorizada que hicimospara la clave quefirma losbloques./endosos/etc.

Tengaen cuenta que debería serposible utilizar otrotezos-firmante (local o remoto)para la clave de autenticación. No heprobadoesto.

tezos-signer supports --require-authentication, --magic-bytes, and --check-high-watermark options. You should understand these.

$ tezos-signer man -v 3
...
  -A --require-authentication: Require a signature from the caller to sign.
...
    -M --magic-bytes <0xHH,0xHH,...>: values allowed for the magic bytes, defaults to any
    -W --check-high-watermark: high watermark restriction
      Stores the highest level signed for blocks and endorsements for each
      address, and forbids to sign a level that is inferior or equal
      afterwards, except for the exact same input data.
...
  add authorized key <pk> [-N --name <name>]
    Authorize a given public key to perform signing requests.
    <pk>: full public key (Base58 encoded)
    -N --name <name>: an optional name for the key (defaults to the hash)

The Ledger baking app by Obsidian validates the magic byte, allowing only 0x01 and 0x02, which are used for blocks and endorsements (respectively). You can find these magic bytes in signer_messages.ml. The "Generic_operation" 0x03 magic byte is used for all other signed operations defined by the protocol: transfers, originations, delegation, voting, etc.

The baking app also keeps a high watermark level to prevent doubles. You should only be able to mess this up with set ledger high watermark (with confirmation on the device), during baking app upgrades (which wipe the HWM), or by using multiple Ledgers for the same key.

If the tezos-signer is secure and working as intended, and you use at least --magic-bytes and --check-high-watermark properly, then it should work roughly like the Ledger app: someone gaining normal access should only be able to sign blocks and endorsements, without causing doubles.

That could still be bad for you, because you might miss blocks/endorsements and lose rewards. It could maybe be bad for other reasons too... But it's not signing transfers!

Using --require-authentication is probably a good idea, but we will have the same problem again. The client (e.g. baker) using a remote signer with authentication must be able to sign all requests to the signer with an authorized key, and we will have the same questions about the security of this authorized key as we did for the key signing the blocks/endorsements/etc.

Note that it should be possible to use another (local or remote) tezos-signer for the authentication key. I haven't tried this.

fuente
Tom

Ah,estaes unagraninformación.Muchasgracias.Con respecto al uso de --magic-bytes y --require-authenticationjuntosespecíficamente,esto suena como la soluciónperfecta.Si utilizo ambosindicadores,¿significa que las solicitudes con 0x01 y 0x02pasarán sin requerir validación,pero latransferencia y otras solicitudes aún requerirán autenticación?Sies así,esoesexactamente lo que quiero.Pero quizásnofuncione deesamanera comomencionas alfinal detupublicación "Usar --require-authenticationesprobablemente unabuenaidea,perotendráselmismoproblemanuevamentepara la clave de autenticación".

Ah, this is great information. Thanks so much. Regarding using --magic-bytes and --require-authentication together specifically, this sounds like the perfect solution. If I use both of these flags does it mean that requests with 0x01 and 0x02 will pass through not requiring validation, but transfer and other requests will still require authentication? If so, that's exactly what I want. But perhaps it doesn't work a that way as you mention at the end of your post "Using --require-authentication is probably a good idea, but you will have the same problem again for the authentication key."
- 0
- 2019-04-05
- lostdorje
editar:pasará sin requerir * autenticación *

edit: will pass through not requiring *authentication*
- 0
- 2019-04-05
- lostdorje
Unticket antiguo,pero de acuerdo conesto: https://gitlab.com/tezos/tezos/issues/185parece que sí,elfirmanteinicial con losindicadores --magic-bytes y --require-authentication deberíafuncionar.Losmensajes 0x02pasarán sinnecesidad de autenticación adicional/contraseñas,etc. 0x03 (transacciones) requeriráfirma (o comomencionaste y vinculado,tal vezelnuevo valor sea 0x04?)

An old ticket, but according to this: https://gitlab.com/tezos/tezos/issues/185 it sounds like, yes, starting signer with both the --magic-bytes and --require-authentication flags should work. 0x02 messages will go through with no need for further authentication/passwords etc.. 0x03 (transactions) will require signing (or as you mentioned and linked to, maybe the new value is 0x04?)
- 0
- 2019-04-05
- lostdorje
No,la validación y autenticación debytesmágicos son ortogonales.Si se requiere autenticación,siempre se requiere.Si se validan losbytesmágicos,siempre se validan (no sefirmaráningún dato con unbytemágico diferente,con autenticación ono). Actualizaré la respuestapara que sea unpocomás clara acerca de losbytesmágicos.

No, magic byte validation and authentication are orthogonal. If authentication is required, it is always required. If magic bytes are validated, they are always validated (no data with a different magic byte will be signed, authentication or not.) I will update the answer to be a bit more clear about the magic bytes.
- 0
- 2019-04-05
- Tom
Juguémás con las cosas y llegué aese obstáculo.Quetiene sentido.Las dosideas deben ser ortogonales.Por otro lado,esteparece un caso de usomuy válido.Deje queelfirmantefirmebloques horneados yfirmeendosos sin autenticación adicional.Sinembargo,si aparece unbloque 0x03 o 0x04,etc.,solicítelopara una autenticación adicional.Esto seríamuy útil,aunquetodavíaexisteelproblema de lospagos automáticos (porejemplo:backerei) y dejar que seejecute sintener que autenticarlotodoeltiempo.

I played around with things more and hit that road-block. It makes sense. The two ideas should be orthogonal. On the other hand, this seems like a very valid use-case. Let the signer sign baked blocks and sign endorsements without extra authentication. However if a 0x03 or 0x04 etc block comes in, require it to have extra authentication. This would be very useful -- although there is still the automated payouts problem (eg: backerei) and letting that run without having to authenticate it all the time.
- 0
- 2019-04-05
- lostdorje
Ignore lo que dije sobre 0x04.Traté de aclarar.Puede que leinterese 0x04 siintenta utilizar unfirmantetezosparafirmar solicitudes autenticadas a otrofirmantetezos;ahíes donde se usa.

Ignore what I said about 0x04. I tried to clarify. You might care about 0x04 if you try to use a tezos-signer to sign authenticated requests to another tezos-signer; that's where it's used.
- 0
- 2019-04-07
- Tom