For client ops, using a remote signer with --require-authentication requires manually entering the client key's decryption password.

It's not documented anywhere -- is this incompatible with baking? There's no way that I'm aware of to decrypt the client key when setting up baking and I assume authentication isn't bypassed for baking.


  • On alphanet it works without entering the password for the authentication key, but in mainnet it ask for password on terminal, but due to absence of any terminal to enter the password it fails. I am also looking out for an answer to this. Feb 22 '19 at 17:39
  • Although you can bypass the authentication method by not using --require-authentication flag in tezos-signer command. Make sure to restrict access to your server and port using firewall though if you bypass the authentication method. Feb 25 '19 at 11:22

On tezos mainnet, you cannot generate your key in unencrypted form. So you have to enter the password to decrypt the key.

Solution is to import an unencrypted key and then use is to authenticate any communication with remote-signer. I used tezbox wallet to generate unencrypted keys and then copy the private key and imported to my server using below command.

./mainnet.sh client import secret key auth-alias unencrypted:edskxxxxxxxxxxxxxTnZR
  • isn't it intrinsically unsafe to generate an unencrypted unencrypted private keys and copy this around for another server ?
    – Ezy
    Feb 25 '19 at 13:29
  • Yes it is unsafe if you are using this key as baking key. But here the only purpose for this is to be used as authentication key, but obviously precautions need to be taken while copying your private key to the server. If you don't want to copy the private key and want to generate the private key on the server only you can use github.com/TezTech/eztz Feb 25 '19 at 13:41
  • 1
    how abt simply using ledger ?
    – Ezy
    Feb 25 '19 at 13:41
  • Yes using ledger would be most secure way but i don't have any experience with ledger. Any documentation for this would be really helpful. Feb 25 '19 at 13:47
  • 1
    Definetly he shouldn't use unencrypted keys - that's a really terrible idea. Feb 25 '19 at 19:45

As touched on in comments, the most correct answer to this is:

No, you cannot use --require-authentication with a signer for baking. There's no TTY present and you cannot decrypt the authentication key when an endorsement / baking operation needs to run.

Best practice here is to use an encrypted tunnel between the signer and the baker and for the signer to not be directly accessible to the network.


There is a way to have more security than both answers (as of today) https://tezos.stackexchange.com/a/607/29 (Answer A) and https://tezos.stackexchange.com/a/598/29 (Answer B) suggest.

If the signer

  • only accepts magic bytes 0x01,0x02,
  • and the signer is firewalled to only accept request from the baker's IP
  • and the tunnel is encrypted (preferably),

it is ok to leave the unencrypted signer auth key in the baker. You get the convenience of answer B, but with the added security of using a signer auth key (answer A). It doesn't protect you against every possibility (it is not possible at this time to pass the password to the baker/endorser, AFAIK even using one of these methods), but by having an unencrypted signer auth key you are still avoiding some potential risks . For example, if a rogue machine obtains your IP (say you release the IP by accident, or your host misroutes your IP) the attacker still won't be able to even simply double bake/endorse.

Some might say it is more work for little gain, but I am a bit paranoid and don't like to take the easier route.

Bottom line, --require-authentication is not a substitute for other precautions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.