junderw

BOLT #N: Recommendations for Cold Storage of Keys

Abstract

For Lightning nodes (especially nodes set up explicitly for earning money routing payments) to work properly, they should have the signing keys for their part of the 2-of-2 multisig script available to their node at all times in order to sign.

This makes it nearly impossible for someone to run a 24/7 lightning node using cold keys without sacrificing transaction throughput to the speed a human can perform their cold signing steps.

Motivation

junderw

Keybase proof

I hereby claim:

• I am junderw on github.
• I am junderwood (https://keybase.io/junderwood) on keybase.
• I have a public key ASDoYhX66stiR0f07xk-EYyEh9z_eQJVYp5ozEJRHLbqpQo

To claim this, I am signing this object:

junderw

// npm install git://github.com/bitcoinjs/bitcoinjs-lib.git#56dfb873d3f05817e19befa976592bc0f371a6d3
// installing the above commit of bitcoinjslib will allow you to take the var redeemScript and
// create a bech32 raw segwit address with this function:
// var bech32address = bitcoin.address.fromOutputScript(redeemScript)
var bitcoin = require('bitcoinjs-lib')
var mnemonic = require('bip39')
// log output near bottom
function main() {
  // mnemonic seed starts here
  var seed = mnemonic.mnemonicToSeed('print common jewel hospital hip fish auction indicate depth ignore ship tissue')

junderw

'use strict';

// first, run   sudo apt-get install jq nodejs npm
// second, run   npm install bluebird co   to install dependencies, and make sure bitcoin-cli can run these commands.
// third, run   node thisScript.js   and it will change all the addresses on your bitcoind into segwit addresses.
var Promise = require('bluebird');
var co = require('co');
var exec = Promise.promisify(require('child_process').exec);

var main = function() {

junderw

#!/bin/bash

# docker, docker-compose, bash, jq, sed 必要。
# このスクリプトはLinuxで作られたので、各コマンドの細かい使い方が違ってたらすみません。
# OSXは使ったことないので。。。
#
# lndのgithubをクローンしないといけません。例えば：
#
# rm -rf /tmp/lndtest
# mkdir -p /tmp/lndtest

junderw

FROM ubuntu:16.04
MAINTAINER Jonathan Underwood

# set env vars for linux user and keybase user
ENV LINUX_USER="kbuser" \
    KEYBASE_USER="youruser"

# use curl to grab the latest build from keybase.io
RUN apt update && apt install -y \
   curl

junderw

# これを実行して lnd を起動
LIST=(\
  188.166.148.62:18333 \
  159.203.125.125:18333 \
); \
INDEX=$((RANDOM % 2)); \
NODE=${LIST[$INDEX]}; \
docker run -d \
           -v /tmp/lndock:/root/.lnd \
           -v /tmp/lndockdata:/data \

junderw

async function pbkdf2(message, salt, iterations, keyLen, algorithm) {
    const msgBuffer = new TextEncoder('utf-8').encode(message)
    const msgUint8Array = new Uint8Array(msgBuffer)
    const saltBuffer = new TextEncoder('utf-8').encode(salt)
    const saltUint8Array = new Uint8Array(saltBuffer)
    const key = await crypto.subtle.importKey('raw', msgUint8Array, { name: 'PBKDF2' }, false, ['deriveBits'])
    const buffer = await crypto.subtle.deriveBits({ "name": 'PBKDF2', "salt": saltUint8Array, "iterations": iterations, "hash": algorithm }, key, keyLen * 8)
    const hashArray = Array.from(new Uint8Array(buffer))
    const hashHex = hashArray.map(b => ('00' + b.toString(16)).slice(-2)).join('')
    return hashHex

junderw

make_keybase_subteam(){
    # usage:
    # make_keybase_subteam myteam newsubteam
    # creates the subteam, sets good defaults, then turns it into a big team.
    # will automatically join subteam.

    if [ -z "$1" ]; then
        echo "need to specify team name"
        return 1
    else

junderw

const CSP_DIRECTIVES = `

default-src
'self'
;
object-src
'none'
;
report-uri
someURL