前置阅读
- 前置条件 - 安装 Go 并构建
simd二进制文件
创建密钥
- 为你的验证者创建一个新密钥：
- 保存该地址，后续会用到：
下一步
你刚刚创建了第一个密钥。现在 keyring 已准备好管理用于与你的区块链节点交互的密钥。 如果你是在将本教程作为测试流程运行，请继续阅读运行节点，以初始化你的区块链并启动节点。 如果你想进一步了解 keyring 及其各种后端，请继续阅读下文。参考：Keyring 后端
Cosmos SDK 的 keyring 支持多种存储后端。私钥可以存储在不同位置，例如文件或操作系统自身的密钥存储中。os 后端
os 后端依赖操作系统特定的默认机制来安全地处理密钥存储。通常，操作系统的凭据子系统会根据用户的密码策略处理密码提示、私钥存储和用户会话。以下列出了最常见的操作系统及其对应的密码管理器：
- macOS: Keychain
- Windows: Credentials Management API
- GNU/Linux:
libsecret 的便捷前端，后者则是 kwallet 客户端。keyctl 是一种安全后端，它利用 Linux 内核的安全密钥管理系统，将加密密钥安全地存储在内存中。
os 是默认选项，因为操作系统默认的凭据管理器通常能够满足用户最常见的需求，在不牺牲安全性的前提下提供更舒适的使用体验。
对于无头环境，推荐使用 file 和 pass 后端。
file 后端
file 后端更接近 v0.38.1 之前使用的 keybase 实现。它会将 keyring 以加密形式存储在应用的配置目录中。每次访问该 keyring 时都需要输入密码，而一次命令执行过程中可能会访问多次，因此会反复提示输入密码。如果你在 bash 脚本中使用 file 选项执行命令，可能会希望使用以下格式来处理多次提示：
pass 后端
pass 后端使用 pass 工具来管理密钥敏感数据和元数据在磁盘上的加密。密钥会以 gpg 加密文件的形式存储在应用专属目录中。pass 可用于主流 UNIX 操作系统以及 GNU/Linux 发行版。关于如何下载和安装，请参阅其手册页。
首次使用前，必须先初始化密码存储：
<GPG_KEY_ID> 替换为你的 GPG 密钥 ID。你可以使用个人 GPG 密钥，也可以使用专门用于加密该密码存储的其他密钥。
kwallet 后端
kwallet 后端使用 KDE Wallet Manager，它在以 KDE 作为默认桌面环境的 GNU/Linux 发行版中通常会默认安装。更多信息请参阅 KWallet Handbook。
keyctl 后端
内核密钥保留服务 是 Linux 内核中相对较新加入的一项安全机制。它允许将密码、私钥、认证令牌等敏感加密数据安全地存储在内存中。
keyctl 后端仅在 Linux 平台上可用。
test 后端
test 后端是 file 后端的无密码变体。密钥会以未加密形式存储在磁盘上。
仅供测试使用。不建议在生产环境中使用 test 后端。
memory 后端
memory 后端将密钥存储在内存中。程序退出后，这些密钥会立即被删除。
仅供测试使用。不建议在生产环境中使用 memory 后端。
使用环境变量设置后端
你可以通过环境变量BINNAME_KEYRING_BACKEND 设置 keyring-backend。例如，如果你的二进制名称是 gaia-v5，则可设置：export GAIA_V5_KEYRING_BACKEND=pass
其他密钥管理
默认情况下，keyring 会生成一个secp256k1 密钥对。keyring 也支持 ed25519 密钥，可以通过传入 --algo ed25519 标志来创建。一个 keyring 可以同时保存这两种类型的密钥，而 Cosmos SDK 的 x/auth 模块原生支持这两种公钥算法。
如需查看密钥管理命令的帮助信息，请使用 simd keys --help 或 simd keys [command] --help。
Prerequisite Readings
- Prerequisites - Set up Go and build the
simdbinary
Create a key
- Create a new key for your validator:
- Store the address for later use:
Next steps
You have just created your first key. The keyring is now ready to manage keys for interacting with your blockchain node. If you are running through this tutorial as a test, continue to Run a node to initialize your blockchain and start your node. For more information on the keyring and its various backends, continue reading below.Reference: Keyring backends
The Cosmos SDK keyring supports multiple storage backends. The private key can be stored in different locations such as a file or the operating system’s own key storage.The os backend
The os backend relies on operating system-specific defaults to handle key storage
securely. Typically, an operating system’s credential subsystem handles password prompts,
private key storage, and user sessions according to the user’s password policies. Here
is a list of the most popular operating systems and their respective password managers:
- macOS: Keychain
- Windows: Credentials Management API
- GNU/Linux:
libsecret convenient frontend, the latter is a kwallet
client. keyctl is a secure backend that leverages the Linux’s kernel security key management system
to store cryptographic keys securely in memory.
os is the default option since operating systems’ default credentials managers are
designed to meet users’ most common needs and provide them with a comfortable
experience without compromising on security.
The recommended backends for headless environments are file and pass.
The file backend
The file backend more closely resembles the keybase implementation used prior to
v0.38.1. It stores the keyring encrypted within the app’s configuration directory. This
keyring will request a password each time it is accessed, which may occur multiple
times in a single command, resulting in repeated password prompts. If using bash scripts
to execute commands using the file option, you may want to utilize the following format
for multiple prompts:
The pass backend
The pass backend uses the pass utility to manage on-disk
encryption of keys’ sensitive data and metadata. Keys are stored inside gpg-encrypted files
within app-specific directories. pass is available for the most popular UNIX
operating systems as well as GNU/Linux distributions. Please refer to its manual page for
information on how to download and install it.
The password store must be set up prior to first use:
<GPG_KEY_ID> with your GPG key ID. You can use your personal GPG key or an alternative
one you may want to use specifically to encrypt the password store.
The kwallet backend
The kwallet backend uses KDE Wallet Manager, which comes installed by default on the
GNU/Linux distributions that ships KDE as default desktop environment. Please refer to
KWallet Handbook for more
information.
The keyctl backend
The Kernel Key Retention Service is a security facility that
has been added to the Linux kernel relatively recently. It allows sensitive
cryptographic data such as passwords, private keys, authentication tokens, etc.
to be stored securely in memory.
The keyctl backend is available on Linux platforms only.
The test backend
The test backend is a password-less variation of the file backend. Keys are stored
unencrypted on disk.
Provided for testing purposes only. The test backend is not recommended for use in production environments.
The memory backend
The memory backend stores keys in memory. The keys are immediately deleted after the program has exited.
Provided for testing purposes only. The memory backend is not recommended for use in production environments.
Setting backend using the env variable
You can set the keyring-backend using an environment variable:BINNAME_KEYRING_BACKEND. For example, if your binary name is gaia-v5, then set: export GAIA_V5_KEYRING_BACKEND=pass
Additional key management
By default, the keyring generates asecp256k1 keypair. The keyring also supports ed25519 keys, which may be created by passing the --algo ed25519 flag. A keyring can hold both types of keys simultaneously, and the Cosmos SDK’s x/auth module supports both public key algorithms natively.
For help with key management commands, use simd keys --help or simd keys [command] --help.