We changed our privacy policy. Read more.

Hot answers tagged

12

The Ledger app itself supports any length from 2 components up to 10, as long as the derivation path starts with 44'/1729'. This allows the Ledger to support either convention, and this support will continue into the indefinite future. As for which convention is better, that is a controversy quite outside of my scope as a Ledger developer :-) but there is no ...


11

All that ledger knows how to do is to offer signatures of different kinds of messages the client app sends it. So in that sense your question refers more to capability of the Tezos client you are connecting your Ledger to (full node, tezbox etc...). At the moment unfortunately the option is not offered in either client to sign regular string messages (...


10

It is possible to have a hot-standby signer albeit I would recommend against it. In order to have a hot-standby, you initialise a second ledger with the same seed as the first one. Then you need a strategy that describes in what cases the standby signer becomes active. The downside of a standby signer is that you lose the double-sign protection that the ...


7

There is an app specifically created for baking by Obsidian Systems. You can install it through Ledger Live (you might still need to enable developer mode in Ledger Live). Instructions here. You can read more about the baking app and wallet app here.


7

Looks like a good start. Unless your (4G)-router has a battery consider an uninterruptible power source (UPS). A second laptop with signer and additional ledger on standby in a separate location close by will improve HA in case of hardware problems, fire/water damage or a prolonged power outage. Probably more important is your software setup. Does the ...


7

The difference is in the default derivation path suggested by the cli. If you use /0'/0' in both (or nothing in both) you should get the same keys. The words are derived based on the hash of the root tz1 public key hash, and a list of adjectives and animals. The lists are sufficiently big that it's reasonably unlikely that you'd end up with two ledgers ...


7

tezos-signer supports --require-authentication, --magic-bytes, and --check-high-watermark options. You should understand these. $ tezos-signer man -v 3 ... -A --require-authentication: Require a signature from the caller to sign. ... -M --magic-bytes <0xHH,0xHH,...>: values allowed for the magic bytes, defaults to any -W --check-high-...


6

The the signer's firewall only allows connections to the signer port from the node VPS who's IP I whitelisted. Because of this, I didn't feel it was necessary to setup signer authentication. This is the main security concern I would have. In general, your setup is fairly secure, however, the main risks are: Because the signer has no authentication, anyone ...


5

There are no very convenient tezos-client commands or RPCs to help with this yet, but one can currently sign a Micheline expression in a conventional way like this: $ tezos-client hash data '"hello, world"' of type string | grep 'Raw packed data:' | cut -d: -f2 0x05010000000c68656c6c6f2c20776f726c64 $ tezos-client unpack michelson data ...


5

The ledger address required for the set ledger high watermark command is what is listed via the command: $ ./tezos-client list connected ledgers Found a Tezos Baking 1.5.0 (commit v1.4.3-21-gf3071161) application running on Ledger Nano S at [0001:001d:00]. To use keys at BIP32 path m/44'/1729'/0'/0' (default Tezos key path), use one of tezos-client import ...


5

Assuming your PKH is a tz1* address, we would know 2/3 parts of how this address was derived, the only part missing would be your derivation path. 1 - seed phrase of the ledger device (assumed known via Ledger device ownership) 2 - tz1* = ed25519 signing curve 3 - Derivation Path As noted on this question and yours, TezBox defaults to 44'/1729'/0'/0'. ...


5

Active accounts For the first question, it depends on what you mean with "active". This term has at least two meanings in the context of Tezos. First, an implicit account (i.e. a Tezos account that is not associated with a smart contract: a regular account that is used to store and transfer tez) is either present or not in the context. The context contains ...


4

There are multiple steps to this process, all of which I think you have already done, but I'll walk through them just to highlight how some of it works. Ledger Setup In order to use the Ledger you have to initialise it with either an old seed phrase from before or it generates a new one for you. You should always ensure that you bought a genuine ledger ...


4

TezBox currenty only supports the ed25519 curve, this is because the underlying library (eztz.js) only supports this curve. We are about to release support for the other two curves in eztz.js in the next few weeks, and will likely roll out support to TezBox after that. The alternate HD paths will be available in the wallet after that, but currently you will ...


4

SOLVED Ref. https://gitlab.com/tezos/tezos/issues/475 Apparently the USER env variabled needs to be set for it to work 😝 It is not set by default in official docker images. I'm reaching out to have them set it 👍


4

You can re-authorize the key using the below: tezos-client authorize ledger to bake for <SIGNATURE> Where signature is the name of the ledger, which you can bring up using: tezos-client list connected ledgers You most likely don't need to register the key again on the blockchain, unless your key has become inactive (you can check on tzscan). In ...


4

Tezbox currently only allows you to view/manage one set of keys at a time. In your case either your fundraiser ICO keys or your ledger keys. Until they add the ability to view multiple wallets/keys, you need to use another wallet software for your 2nd set of keys. If you want to stick with Tezbox only, you can use it in a different browser or use the Tezbox ...


3

Authorize ledger for baking This will allow the ledger to sign operation without "human interaction" each time. $ tezos-client setup ledger to bake for <ALIAS> Register as delegate This is how you register as a baker on the network. $ tezos-client register key <ALIAS> as delegate


3

Here you can find the guide from the developers of the Ledger Nano baking app (Obsidian System). However, I would recommend to download the app from Ledger Live and not compile it yourself, and then follow the guide from after the compiling instructions.


3

First of all, when storing tezos using an HSM one still needs to connect to a node in order to perform operations like transactions or delegation. For this there is the choice between connecting to a local full node (see here or there) or wallet services that offer support for HSM, like Tezbox, Galleon (as of now Kukai does not support HSM I believe). One ...


3

You can now download both the Ledger Tezos Baker and Ledger Tezos wallet directly within Ledger Live, bypassing a lot of the CLI work necessary before this existed.


3

WARNING: The following hack is dangerous because it treats your message as an operation which could be reinterpreted in a later context to mean something you did not intend. You can actually convince the ledger to sign arbitrary things right now. It will display a "Sign Unverified?" prompt: tezos-client sign bytes 0x03$(echo "hi there!" | xxd -ps | tr -d '\...


3

The the signer's firewall only allows connections to the signer port from the node VPS who's IP I whitelisted. Because of this, I didn't feel it was necessary to setup signer authentication. I would flip this. Block all incoming connections to the signer and instead have the signer connect to the TF. That way you don't have to worry about a malicious node ...


3

edit: only tried locally, not remote. I suggest you try signing dummy bytes. This will fail. But the way how it fails will tell you if your ledger is connected in the right way and if your signer still responses. tezos-client sign bytes 0x03 for "<my_ledger_address>" Will give you the error you got if the ledger is in baking mode, looking like this:...


3

I found the answer to my own question the fix was to correct the import command as follows tezos-client import secret key <alias> "ledger://<animals>/ed25519" --force


3

High watermark is the lowest block number that your ledger is allowed to sign bake or endorse operations. That means if the watermark is set to 100000, the ledger is disallowed to sign any block number 100000 or below. This is a mechanism to prevent double baking. The ledger-app documentation states: When updating the version of Tezos Baking you are ...


2

The main risk with using multiple ledger/bakers is the risk of double-baking/double-endorsing which will make you lose your bond. So technically the answer to your question is "yes" however to be proper it relies on your setup's ability to make sure that at any one time at most one baking node is able to talk to the network. There are various ways to ...


2

Ledger has indicated that applications for the Ledger Nano S will also work on the Ledger Nano X, although by default they will not take advantage of the device's difference from the Nano S such as the larger screen and bluetooth capabilities. We (Obsidian Systems) are awaiting delivery of a few Ledger Nano X devices so we can confirm that and begin ...


2

It is not possible and for a very good reason: The whole purpose of ledger is to protect the secret key of the addresses it manages in its secure element so that no one can access it. If you could “import” a secret key that you can have access to then by definition it would mean that this secret key may have been compromised already so there would be no ...


2

The ledger maintains a HWM (high watermark) for "double bake protection" - this means it will not sign more than 1 block at a certain height. I do not believe it is possible to maintain multiple HWMs with a single ledger (except for testing period chains), and so you might get in trouble if baker A signed a block for height X+1 just before baker B tries to ...


Only top voted, non community-wiki answers of a minimum length are eligible