Skip to content

Commit a676d90

Browse files
Update adr-016-validator-consensus-key-rotation.md
1 parent 3b7041b commit a676d90

File tree

1 file changed

+11
-11
lines changed

1 file changed

+11
-11
lines changed

docs/architecture/adr-016-validator-consensus-key-rotation.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,42 +9,42 @@
99

1010
Validator consensus key rotation feature has been discussed and requested for a long time, for the sake of safer validator key management policy (e.g. https://github.com/tendermint/tendermint/issues/1136). So, we suggest one of the simplest form of validator consensus key rotation implementation mostly onto Cosmos SDK.
1111

12-
We don't need to make any update on consensus logic in Tendermint because Tendermint does not have any mapping information of consensus key and validator operator key, meaning that from Tendermint point of view, a consensus key rotation of a validator is simply a replacement of a consensus key to another.
12+
We don't need to make any update on consensus logic in Tendermint because Tendermint does not have any mapping information of consensus key and validator operator key, meaning that from Tendermint's point of view, a consensus key rotation of a validator is simply a replacement of a consensus key to another.
1313

14-
Also, it should be noted that this ADR includes only the simplest form of consensus key rotation without considering multiple consensus keys concept. Such multiple consensus keys concept shall remain a long term goal of Tendermint and Cosmos SDK.
14+
Also, it should be noted that this ADR includes only the simplest form of consensus key rotation without considering the multiple consensus keys concept. Such multiple consensus keys concept shall remain a long term goal of Tendermint and Cosmos SDK.
1515

1616
## Decision
1717

1818
### Pseudo procedure for consensus key rotation
1919

2020
* create new random consensus key.
21-
* create and broadcast a transaction with a `MsgRotateConsPubKey` that states the new consensus key is now coupled with the validator operator with signature from the validator's operator key.
21+
* create and broadcast a transaction with a `MsgRotateConsPubKey` that states the new consensus key is now coupled with the validator operator with a signature from the validator's operator key.
2222
* old consensus key becomes unable to participate on consensus immediately after the update of key mapping state on-chain.
2323
* start validating with new consensus key.
24-
* validators using HSM and KMS should update the consensus key in HSM to use the new rotated key after the height `h` when `MsgRotateConsPubKey` committed to the blockchain.
24+
* validators using HSM and KMS should update the consensus key in HSM to use the new rotated key after the height `h` when `MsgRotateConsPubKey` is committed to the blockchain.
2525

2626
### Considerations
2727

2828
* consensus key mapping information management strategy
2929
* store history of each key mapping changes in the kvstore.
30-
* the state machine can search corresponding consensus key paired with given validator operator for any arbitrary height in a recent unbonding period.
30+
* the state machine can search corresponding consensus key paired with the given validator operator for any arbitrary height in a recent unbonding period.
3131
* the state machine does not need any historical mapping information which is past more than unbonding period.
3232
* key rotation costs related to LCD and IBC
33-
* LCD and IBC will have traffic/computation burden when there exists frequent power changes
33+
* LCD and IBC will have a traffic/computation burden when there exists frequent power changes
3434
* In current Tendermint design, consensus key rotations are seen as power changes from LCD or IBC perspective
35-
* Therefore, to minimize unnecessary frequent key rotation behavior, we limited maximum number of rotation in recent unbonding period and also applied exponentially increasing rotation fee
35+
* Therefore, to minimize unnecessary frequent key rotation behavior, we limited the maximum number of rotation in recent unbonding period and also applied exponentially increasing rotation fee
3636
* limits
3737
* a validator cannot rotate its consensus key more than `MaxConsPubKeyRotations` time for any unbonding period, to prevent spam.
3838
* parameters can be decided by governance and stored in genesis file.
3939
* key rotation fee
4040
* a validator should pay `KeyRotationFee` to rotate the consensus key which is calculated as below
4141
* `KeyRotationFee` = (max(`VotingPowerPercentage` *100, 1)* `InitialKeyRotationFee`) * 2^(number of rotations in `ConsPubKeyRotationHistory` in recent unbonding period)
4242
* evidence module
43-
* evidence module can search corresponding consensus key for any height from slashing keeper so that it can decide which consensus key is supposed to be used for given height.
43+
* evidence module can search corresponding consensus key for any height from slashing keeper so that it can decide which consensus key is supposed to be used for the given height.
4444
* abci.ValidatorUpdate
4545
* tendermint already has ability to change a consensus key by ABCI communication(`ValidatorUpdate`).
4646
* validator consensus key update can be done via creating new + delete old by change the power to zero.
47-
* therefore, we expect we even do not need to change tendermint codebase at all to implement this feature.
47+
* therefore, we expect we do not even need to change Tendermint codebase at all to implement this feature.
4848
* new genesis parameters in `staking` module
4949
* `MaxConsPubKeyRotations` : maximum number of rotation can be executed by a validator in recent unbonding period. default value 10 is suggested(11th key rotation will be rejected)
5050
* `InitialKeyRotationFee` : the initial key rotation fee when no key rotation has happened in recent unbonding period. default value 1atom is suggested(1atom fee for the first key rotation in recent unbonding period)
@@ -108,12 +108,12 @@ Proposed
108108

109109
### Positive
110110

111-
* Validators can immediately or periodically rotate their consensus key to have better security policy
111+
* Validators can immediately or periodically rotate their consensus key to have a better security policy
112112
* improved security against Long-Range attacks (https://nearprotocol.com/blog/long-range-attacks-and-a-new-fork-choice-rule) given a validator throws away the old consensus key(s)
113113

114114
### Negative
115115

116-
* Slash module needs more computation because it needs to lookup corresponding consensus key of validators for each height
116+
* Slash module needs more computation because it needs to look up the corresponding consensus key of validators for each height
117117
* frequent key rotations will make light client bisection less efficient
118118

119119
### Neutral

0 commit comments

Comments
 (0)