ETH2 Staking Community Call #5 - Jim McDonald of Attestant and ethdo

Transcript

so I want to welcome everybody to the etherium community staking call number five this call is generally tighted titled aetherium to our special guest today is Jim McDonald I met Jim through reddit when he posted or someone posted a test into the IO as a blog and my immediate response was I don't know who this guy is we shouldn't trust him and I was swiftly corrected and realized shortly after that Jim is the master of the East do he manager wallet manager that that I'm

fond of and he is behind a test and tonight we're going to talk mostly about etherium to wallets and wherever else he wants to go before we get too far into that introduction let me tell you hello my name is super fizz you can call me fizz or whatever you want to call me I do have a real name somewhere my co-hosts for tonight as always is Lambeau she who is slowly growing to be Nolan his official name and Patricio Worth altar is with us tonight representing Poe app Patricio do you want to tell us a little bit about fouetté before we start yes my pleasure

um so Bob keeps every attendee and don't find she will token on the video magnet or ideally gives a token because right now the gas is so expensive so the minting fees are complicating our operations but the idea is that you get these tokens are only you own and you can use to claim that you were part of this community early on and in the future you may get access to some different opportunities even that you are a person that will committed to the community there were pull up on previous talks and hopefully there's going to be pops of the upcoming ones so make sure you get them the way they are delivered is that you get a private message on the zoom

chat from Bacchi and you have to make sure that you click the link or you open it before the cult finishes because once the call is finished the chat goes poof so you don't get the token any longer if something doesn't work be a witch it work or you wanna learn more feel free to reach out to me personally or get into follow-up XYZ on Twitter or telegram or anywhere else I think that's it and please ensure the call and ensure the privilege of having such a master as as an owner speaker today all right thank you so much Patricia and I before I before we go to the next step I want to say this community is where we

identify ourselves as the etherium to staking community we generally are based at reddit.com slash are slash eats taker but that is more of a conversation platform for us than our entire identity like I said our intention is to as much as we can represent all of the etherium staking community lambo she do you have anything you want to say before we hop in here no I don't think so let's get underway I'm excited for this one all right me too so I'm gonna spot like Jim and I've given his introduction so Jim if you'll

just pick it up I think you know the big scheme of things we want to know what is wallet management like and he managed my life in aetherium too cool thank you very much so yeah I would I would say the the best description is nascent we're not there yet by any stretch there's been an awful lot of work done over the past few years on building aetherium two nodes looking at the beacon nodes of validators and similar keys have very much been a means to an end until now so most of the nodes out there will allow you to generate keys they will be written to disk in various forms and some of those forms

are old so for examples on use the old aetherium one keister or some of them are just simple unencrypted dumps of of private keys so there's a range of things out there there has been work done to try to provide standards for these and that's something that is is ongoing and that's great to see but one of the things that we don't have or haven't had historically has been a way of having those keys separate from the nodes themselves now we want to have key separate from nodes for various reasons so one of them is it allows us to move

keys from one one type of node to another you want to move from prism to lighthouse then you can do that if you want to move from lighthouse to Deku you can do that so that's certainly one of the reasons why we're looking more and more key management pieces the other one is that the operational security of your keys are actually very very different from what you would expect on the theory in one system so in theory 'm to validators have two keys one is called the validator key the other with the withdrawal key ideally a withdrawal key should not touch possibly never touch a machine that is connected to the

internet so your withdrawal key is is very much the thing that you want to keep safe most systems at the moment the nodes will create both validator and withdrawal keys at next to each other so because of that that causes a situation where immediately we're not into the best operational security now of course we do expect this to change before the nodes go live we expect to see a lot more of this kind of level of security coming in and all we need to do is make sure there are options available now as early as possible to be able to keep the withdrawal key secret to be able to ensure that people can start to get the hang of the operational security that they are going to need when aetherium 2

goes live I'm your mule super fees well sorry uh in our pre meet you talked we talked about some of the new features of aetherium two wallets that you know we're all getting we're getting used to a theory m1 wallets now after five years can you talk to us about some of the features of aetherium two keys that keys and wallets that that we just may not even be aware of it all sure so one of the the biggest things is difficult for people to wrap their heads

around when they start looking in aetherium - and specifically the validators is this idea that there are two separate keys for a single validator so there is what is called a validator key and a withdrawal key that withdrawal key owns the 32 ether deposit it retains a fridge to either deposit any money that is earned as a result or validating goes into that same account and always control by that withdrawal key so the withdrawal key holds the funds the validator key uses the funds to a test to propose blocks a few other bits and pieces so and there's a nice separation between the operational side what you

are doing on a day to day basis where you need your validator key to be available to be online and what you want to ultimately be able to do which is withdraw your funds and use them for other purposes which is something that the draw key will do so as we say these are very very different keys with very very different uses however that that's never really made explicitly clear again a lot of the nodes when you create a new key you create a validator key automatically created withdrawn key without telling you and ends it in so you don't even know half the time what's going on so the idea between having a valid a turkey and all the draw here

something that is that is very new and that's something that's very important that feeds into how those keys should be created how they should be stored there's a whole bunch of things around in terms of who actually owns and uses those keys so because they're two separate keys you can get into realms such as non-custodial staking where one user holds funds the other one holds a validator key so there's a whole bunch of things there you can do it's a relatively flexible system but again it's one that doesn't come without complexity and it's very important that people start to understand the difference between the two keys how they should work where they should reside how

you should look after them so the biggest difference from the outside is that there are two different keys are are the wallet addresses still the same 64 string length or is that is that different are the private do they look different on the outset then III monkeys so with a theory m1 what people generally think of as keys is actually addresses so the the 40 digit address that you'll see which is normally a hex string it is normally a mix of upper and lower case numerical alphabetic characters along along with the 0 to 9

is a an address so that is actually a truncated hash of a public key which immediately is painful to think about a theory m2 uses something similar to a theorem one in terms of how it creates keys and uses keys it has a separate curve which without getting into the details is a different way of generating a private key generally a public key from a private key and it uses that for various things under the hood but one of the things that a fear IAM two does not have yet these addresses so when we think of Ana theory on one address which is that 40 character string we don't

have the equivalent aetherium to purely because we don't have use of transactions yet so we have no need to create an address when we do there is most likely to be a much more friendly for that we have learned quite painfully over the past four or five years that not having checksums in addresses as a primary method of the format has caused people to lose funds they miss type of character they miss a character off the end and it assumed there was a zero in the front those type of things that happen can cause big pain so and at this moment in time we do not have an address format but we will have by the time that

they become useful in the meantime the etherium two keys public keys are actually a lot longer in aetherium to man in aetherium one so they're significantly larger in that respect and but they they look similar in the fundamentally they're all big numbers which normally represented by hex addresses it is something that we need to get that the hang of and this is something actually we've talked a little about what it wallets or Maalik management the standards are starting to have for example names automatically attached to wallets automatically attached to addresses this becomes very very useful because now when we want to

talk about an account we can say I want to exit validators slash 17 that is an awful lot easier than looking a lot of different hex rings trying to ensure you have the right one and similar so again a Z standards don't come through for a theory and - we are learning from a lot of the not necessarily mistakes but the the early decisions that we didn't make to allow that user friendliness to come in so certainly we are seeing public keys of a significant size they are not mapped to addresses yet but hopefully that will become less and less important as we start using more friendly names and and similar is still gonna start

with a X so all of the hex rings we'll start with o X so when we look at public keys and private keys we're gonna see o X when you look at the current idea of where we may go for aetherium two addresses one of the ideas is you take one of the standards actually came out of Bitcoin something called s32 which is a relatively nice format it includes a prefix so we can have a prefix for the main net we could have separate prefixes if we wanted for test nets or up and running so there's immediately something that we we didn't have an ethereal and then we can move to the fact that it has lots of good check

sums in so actually the chance of miss typing either by missing characters or transposing characters the chance of the checks on validating is very very low so and we are likely to see something that has those properties if it is not exactly what the the Bitcoin guys are already doing with with 32 so it's gonna be something of that ilk but certainly user friendliness not in terms of length on fortune there's a limit to what we can do there because it has to store a certain amount of data but in terms of being able to clearly see what what network we are we are using the address on ensuring that we don't slip up when we miss type those things are something that I think are going to be pretty

important and high on the list when we start to look at an actual address format for aetherium - so I kind of presumed that anyone who is interested in wallets for aetherium - right now since transactions won't be possible for what looks like a year there only are primarily interested in staking and so from the perspective of securing funds as a Staker since we don't have any any assumption when Hardware wallets might be available what how would you how would you guide us as far as best practices toward for securing our it's a lot of eath for a lot of people for

securing our keys as we as we enter staking so there are a couple things you have something you mentioned them which is very important to know is that yes as of today there are no hardware wallets that support the etherium two keys so unfortunately that takes back again sort of 6-7 years in time to when we have to look at other ways of keeping key secure as we mentioned there are two separate keys withdrawal keys and validator keys if you were looking at a high security system you would probably look at a single server that was fully offline what that offline server would do would be to actually

generate both withdrawal keys and validator keys so that would be an offline server that Worthen generate both withdrawal and validator keys the reason why you want them both on the offline server is because it allows you to easily create the deposit data which is the information you input on the etherium one chain to create an etherium to deposit so you have an offline server where you have your withdrawal keys you have your validator keys you can create deposit data what you can then do is using a USB stick or similar you can take the validator key and the will and the deposit data and you can put them on to live networks a deposit data as we mentioned will go on on the theory and

one transaction the validator key you will put on one of the one of the beacon nodes and the validators there so you know your prisms your lighthouses so what you then have is a situation where you have your validator key active on a server now that is obviously a concern if we assume for a moment and let's let's do that because it is you if we assume we take our withdrawal key and we dock it in a safe or whatever it might be let's assume that one safe and that one secure you know we can use crypto stills for that we can create a hierarchical deterministic wallet and we can just all

the seed for that to create them back that's all safe protection of a validator key is a much much more difficult problem the reason for simple is that every six minutes a validator key must be available and online to sign something always an attestation in addition to that potentially a block proposal there are a couple of other things the hood were again signatures are required using these keys so because of that even if we go to the stage where we had say Leger decided that tomorrow they can support the etherium to curve it wouldn't really work because you'd have to be sitting in front of your Trezza

device every six minutes to say yes I approve this transaction yes I approve this transaction so a lot of the things that we are used to in terms of key security unfortunately don't quite work for us the main and the obvious thing that we can start to do is protect the server on which that key resides so ensuring that our server is secure that it is not running a whole chunk of other services on there making sure we have a firewall in place all of your traditional operational security is it's very very important the problem main remains that you have a single key or a

key on a single server which is vulnerable if that server is hacked the key will be stolen and if you have someone decide they want a denial of service your machine then you can no longer carry on because that key is in one place so because of that as we spend more time looking at the world of validators we realize that there are various things that we need to start doing to ensure that without decreasing the usability of the system we can increase the security of the key and and that there's a number of initiatives we can we can chat about there but there's

a lot going on there to try and see how we can keep this combination of having the key available and ready to sign things whilst at the same time avoiding the issue of making the key too easy to steal and as a result you just potentially having their funds lost okay one of the things I want to probe at you said the best heat generation standard was an offline server now that could be something as simple as a Raspberry Pi that's running keygen software right like it doesn't have to there's no no need for horsepower it could be a simple appliance that's air gapped

to generate those keys right absolutely you know the the power requirements are very very low there are beer there is BLS code out there for most of the architectures that we know of so it's pretty pretty easy to run this on anything you can get computers that sit on USB sticks yes you mention the Raspberry Pi an old laptop you know there there's lots and lots of options out there the important thing with out is just that you make sure that once you you start using it that you keep the whole thing egg app so the those were the role keys will not make their way onto any kind of net connected machine and so in the absence of a hardware wallet it's I'm assuming at

least I know I'll be using an HD generated wallet and I because I'm a weirdo I'll probably do rolling dice and flipping quarters to create my HD wallet and then brute force the checksum which I I assume is is at least as far as I know is a secure way to generate it in terms of using so we've got the validator key and the withdrawal key do our people assuming are they gonna have two different HD seeds is that is that how that would work so personally I would recommend it the reason being that again if you want to

have some way of accessing your validators let's say the server on which your validators was running catches fire and you need to recreate those keys if you then have to put in a seed that could also recreate your withdrawal keys that is going to be less secure than just having a separate seed for the validator so keeping those two things separate in every way possible is in general good secure do you practice am I correct to assume that HD wallets are probably the most logical route for for our level of end users is that yeah I mean again it depends um with an

HD wallet they're very very useful for validators if you're creating multiple validators certainly that's great because you have a single seed and then you can create multiple validators you do not need to have separate withdrawal keys for each validator they can all be the same withdrawal key so if you end up in an environment where you have a withdrawal wallet seed any single account maybe you want to think about doing something different in terms of how you create that and certainly as we say you know an HD wallet has lots of advantages if you want to create multiple withdrawal accounts and that's great if you just want one then then maybe there are other options the other the other thing with with individual

keys again is is it at some stage you might be thinking well actually I want to find some higher level of security than what I have at the moment and there are ways to do that for example the traditional one is issuing secret sharing where you can take a single key you can break it into multiple pieces and then you have what's called an and mmm of n system for example you might put the key in three different places you need two of those different pieces to be able to recreate the key so that type of thing starts to become interesting as well a lot of that thing comes down to functionality so if you do sameer secret sharing on a seed that's fine but you lose a chunk your functionality in that you can't create

new keys or similar or whatever within having those pieces Shamir's secret sharing scheme that would be an offline solution for storage right that wouldn't be a computational solution I mean I know it's kits generated computationally but my my use of that has always been like here give it to my buddies physically yes or is it it's not a computational solution no no and and again that baddies the type of thing you dude you said before you before you move the key away and and then forget about it as we know with etherium to say zero is not going to allow us to carry out transfers phase one kind of maybe might let's not worry too much about the details it people are still kicking it around so we might be able to have

transfers in phase one but they are at least a year away if not longer so certainly being able to protect those keys withdrawal keys in in some sensible fashion of bearing in a box and forgetting about it is is probably the the single safest way of doing that you want to do that with a HDC door you want to do that with the the private key itself it's much of a muchness okay so I I love that you've given us so much practical guidance because this is uncharted territory and it is it's so much to consume for any of us like we hold these these conference calls just because it's as end-users like it's it's overwhelming and I so it's great that

you have so much of background in this and Patrice you've asked a great question and something I have haven't thought about what what gets you where you are like what what background have you had that has allowed you to be so knowledgeable about about these this cryptography uh well I mean my background itself goes back quite a long way now about thirty years or so I started working with computers I did a computer science degree and Ed Murray University back in the 90s and a lot of my time there was actually spent not doing computer science degrees but working on a public access system that they were running so we we were running the I think the second public access

system on the planet in terms of computer systems and it was a great grounding and from that it was really a whole bunch of different jobs both through technical through management I've worked in small and large companies etc etc the background for me has always been I want to know how a technology works if we're going to use it so if I'm selling something if I'm building something if I'm using something I want to dig in and see how it works and I mean that led me a long time ago to Bitcoin I rewrote bits of a Bitcoin explorer back in 2013 I think it was or something like that

and but then after that it really was was a case of keeping an eye on on the technology and seeing what it was doing so in terms of understanding generally speaking I will pick a project I will start to dig into it I will start to raise the odds against that I will you know sort of smooth out some of the rough edges and similar so you start with a lot of the less functional stuff but really find your way around the codebase and work from there and if theory I'm to in itself has been interesting because it's mutated quite quickly so what aetherium to look like a year and a half ago is not particularly similar to etherium to look like now as

such it is becoming less off but it's still a little bit of a moving target and and the basin to do is is just to get involved find an area where you have some post experience or some knowledge help out get involved in and you'll just start to soak it up and that's probably the the single best way of getting involved in in any project is just to pitch in and help out wherever you can and that allows you to understand what's going on it allows you to be able to start to sort of see see the shape of these of these projects for me I mean if I go back to if theory and math you

started on a side project working on state channels and I went from state channels to a whole bunch of other little areas and in pieces inside aetherium where there were the bits that weren't doing what they should or they just weren't working the way that I wanted them to so you kind of pitch in and you you start to play around with stuff and and you know if people like your work they accept it if not they don't that's fine and that you learn so certain certainly cryptography and aetherium and cryptocurrencies in general feel like they are massively massively technical undertakings and the chunk of it is certainly having a bit of ability

with maths help being able to understand crypto helps up to a point but you don't really need to understand that to know what's going on inside aetherium if you look at aetherium - and proof of stake an awful amount of it is game theory it's understanding how do you stop people from being bad actors how do you ensure that the right people are rewarded and the wrong people are punished how do we make sure that regardless of who wants to watch the world burn we can keep this chain running so you know that a lot of that is again that's not coding that's thought that's playing around with game systems and similar so there's a whole bunch of areas there that are very very interesting and as we've pulled out

before block chains are wonderful technical endeavors but they're also wonderful social and economic endeavors - so there's a huge problem space out there for people to tackle in their own areas of interest and their own experience and similar so yeah you know there's a there's a huge amount out that are getting involved in in in all areas yes I think most people who know about your contributions at least at my level I don't know I can't speak for anyone elses experience but we see the attested daehwa blog and so do you want to tell us a little bit about what a test until and how it fits into to this whole picture and and where it's headed

sure and a testing is a good example of something that came out of the problem statement which is that it would be absolutely great if we could have a system that could could stake for us so a testing and and you mentioned mentioned the blog and a lot of those was let's see if we can understand this to the depth where we can explain this clearly and simply to anyone who's passing by so that was important for us to be able to do that once we've done that and once we spent more and more time in it and and again you know it's a lovely idea that the thing will be

fully decentralized we found the testing are all big fans of decentralization but the reality is is it being able to actually have to look after servers 24 by 7 is a significant task now yes servers can go offline if they're staking that's ok but how long can they really go offline for how long are you prepared to let them go offline for what are your costs to sit there and keep your server up-to-date to keep reading about all the latest updates for all the various nodes to run 3 or 4 different nodes to test them and then test them again Turing ones data and then test them again three months later so there was a lot of work involved in in staking now that's fine you know we there is

always going to be a barrier to entry for these things there are requirements to have these things working so a testing initially was a project that we built internally to say well we would like to stake our own Aoife in a system that is far friendlier for us far easier for us to use as a group of six of us although hold ether how can we build a system that would actually mean that we're not all spending a significant amount of time looking at chasing down bugs fixing issues ensuring uptime ensuring security etc etc so the idea for a testing really came came from that question of well can we build something that he's a good staking service now

what we didn't want to do though was was go down the road of saying well what actually we'd like to do here is take everyone's ether because again being ether older holders ourselves one of the things you said is well we don't really like this idea of giving up control fortunately as we mentioned with aetherium 2 we have these two separate keys a withdrawal key in the validator key so one of the things we looked at very early on was a question of well can we separate these two keys can the ether holder retain the withdrawal key without having any impact on the validators ability to stake and the answer is yes you can so that's that's a feature that we find is is actually stick we're very happy with the idea

that what we can do is we can turn around and say okay great we are non-custodial you can keep your key no problems at all we're happy with that we'll run the validator you control the funds everyone's happy so that was a big piece of where that came and one of the things and of course it ties back to key management one of the things that we have as an ongoing question is how do we keep fun safe now most people have gone out there and read through and you know looked up on bits of aetherium - and one of the big things they crash into relatively early on is this idea of slashing so slashing is a massive concern we expect that we will see

slashing from a couple of major areas one would be malicious users hacking so someone hack steals your key has a bit of a laugh with it by burning all of your funds well that's very nice of them but hey so that's not a good thing so we want to avoid that if we can the other one is is just software bugs we've seen various software bugs in protocols so far so either inside the protocol itself or inside the implementation by individual clients and we don't expect them to go away more importantly we also expect that although we found a bunch of these and a bunch of people have been

kind enough to point our issues and errors once there is real money involved we expect that to step up significantly both in terms of the attacks that are going onto the network and the ability for people to have probably already found attacks to keep them and then there's going to start playing with them as soon as real money hits so there's that concern of how do we stop slashing which is which is a huge area so one of the things that the testin have been working on is what we call a remote signer so the idea of a remote signer is that you can take your keys and you move them away from the validator you put them on a remote signing box putting on

a remote sign is very useful for a few reasons one is a if it's a dedicated box you have a much smaller footprint for attack so realistically you will have one port open that port will be purely for taking signing requests so you can protect it a lot more than you could if it was a generic box that's running say a aetherium 2 node maybe some metrics on it for sending information out to out to Eve to do stats excuse me so there's a whole bunch of things there that you can do that you have to worry a little bit about less when you've got a dedicated signing box second thing you can do is you could start to put slashing protection in place so what you do is rather than just sign anything you're

given you put a whole bunch of constraints around it so they can be technical constraints around for example okay if we did this we know we signed something five minutes ago if we sign both of these things someone could use that to cause slashing attack so we're not going to do it we can restrict which IP addresses and servers and all that kind of stuff can actually access the signing so you start to build in a system where you have stronger and stronger protections the other reason why a remote sign is very interesting is because although as we said earlier there are no systems out there today in terms of hardware keys to support the etherium to curve there will be and when there are that means that we can

actually have a remote signer that uses the hardware key rather than software keys as we have at the moment which will of course give us another layer of protection as well so as we start to do this we we find ourselves with stronger and stronger protections and these are the type of things that we are going to have to build in force takers big and small it's you know someone might have a thousand validate it's great somewhere I have one validation doesn't make any difference you know the impact to them of of being slashed or being offline is it is very similar in terms of percentage loss so we want to make sure that these features and functions are available for everyone as we mentioned

you know this is all going to be open source stuff there is there is some open source code out there already and and and it keeps being added to so certainly that's something that we we believe very strongly that the more this is used the safer staking on aetherium to becomes the higher participation we get the mosque here the network is uh you you said something that had not crossed my mind before I know Nolan and I both Limbo she also we're using a to server set up and my my initial design was was that they would switch back and forth between validating but you you raised this the suggestion of the

architecture being the primary server running eath too and then behind that the signing server is that I that's that's kind of new to me it's it seems like a really great idea can you just elaborate because it I just I liked it I hadn't thought of it yeah so she's me so yeah it gives us a lot of ability so one of the things that allows us to do is run active active servers so if we look at a test and service at the moment the ones that running on the Topaz Network we have to be connotes to validators the validators all have the same keys on them but the validators both talk to the same remote signer what

that means is when the validate has come to a test for example they will race each other they will go and talk to this remote sign in the remote signer will sign the first one that gets in it will refuse a second one so that allows us to bring servers up and down relatively easily and painlessly so that that type of thing is very very useful and you know we also want one of our problems of course with something like this is you never know if your thing is actually working or not so a week a week and a half ago now I actually turned off the clashing protection piece to see how it worked interestingly it actually ran for a couple of days before we had a bunch of slashings and but the nice thing is we

did get a bunch of slashing so we can see that it was working I've now turned it back on I think so we're now back in a world where well being protected against slashing so that kind of thing is is really really useful unfortunately having built this architecture what we next find of course as always and we're just moving weak points around we now have a single signer so we mentioned earlier the idea we didn't want a single point of failure so one of the things that we have with a single signer is a single point of failure so the next step is to find a way of distributing the signer so we are now into a world of things that are under development rather than them

publicly available certainly we expected to be publicly available pretty soon pretty soon being in the next month or two but what we're doing at the moment is looking at having multiple back-end signers so we mentioned shimmy secret sharing early the idea that you could break a key into three pieces and and have two of them available for signing any two of them so we're looking at something similar to that but a little bit more advanced so shimmy secret sharing it's great in that it allows us to take a known secret break it into multiple pieces so we could have three separate back-end signers and any two of them would be enough to create a valid signature that's great that's wonderful our problem with that is that it

requires us to know the secret to begin with now as stands at the moment you may think well don't understand what the problem is nothing wrong with that right you know at the moment I know a validator secret key I'm going to end up still knowing a validator secret key there's been nothing lost so certainly if we go that that route then we end up in a world where we have more resiliency as we said we can lose one of the three signers and we can still carry on as normal but again we want a more decentralized world where possible so one of the the great things of the new aetherium to curve gives us is something called distributed key generation with distributed key generation we can take

those three remote signers we can get them to talk to each other to create a validator public key but it is a validator public key which no one knows the secret key of no one so it's the secret key is never actually created what happens is is a secretly the public key is an aggregate of individual components the secret key likewise what we can actually then do is create a world where the three signers each of them have a piece of that secret key any two of them again can create a valid signature but at no point in time has a secret key ever actually been

created and exposed now this is really really important not for us today for a testament setting up three servers and running a signer across them not for some guy with you know a server in his basement who decides he wants to run something in the cloud and have his sign is safe there but it allows us to something where potentially anyone can run a signer and when we create keys then those users can choose a signers that they that they want to trust and again those signers can be Hardware signers they can be software signers you might say you know what I'm gonna trust Microsoft and Amazon and Google and I'm

gonna run you know there's a guy down the road I know who's running while I'm gonna get five in total and I'm gonna trust any three of them now the nice thing with that is you can be pretty sure that Amazon Google and Microsoft you know they're not really gonna collaborate to steal your key so by having the ability to set up antagonistic partners who each have an interest in serving you from their infrastructure but have no interest in collaborating with the other people who are serving your keys then you you end up with a world of even higher security so now we have a world in which secret key is never never presented anywhere the people holding the fragments of the

secret key are not going to cooperate with each other to to expose it but you still have the ability to for you as the ultimate holder to be able to ask them to create signatures and so it's it's it's a very very strong system a lot of this is is you know a fair way down the line and there's a lot of work to be done the technical piece is relatively well understood the harder piece is creating the governance to do this just simply saying well how do the server's all talk to each other convincing people they want to run these signers is another big area so it's something that certainly long-term we want to do but what we're trying to do you know certainly the testing but

generally in the wider aetherium to community is try and keep moving ourselves towards that so as you said you know we have a remote signer we'd be bringing out the split remote signer with distributed key generation over over the next couple of months the idea is to make these things available and then hopefully over time as best practice come starts to come through we will see more people become interested in doing that and providing higher and higher levels of security for validator case and it cannot be stated to strongly how important is to protect those validator keys and we we are in a bit of a weird world in that as we said you know traditionally you either have hot keys or cold keys stuff that's cold you

don't touch because you care about a lot of stuff that's hot use available online simple to use but generally though low value validator keys are both high value and need to be online all the time so the more solutions we can bring around keeping those things as well protected as possible it's important technically it's important economically for all of the individual holders and also for the etherium to network because once you start seeing large numbers of people getting slashed a lot of the concerns around the not the safety of staking but the safety of you staking rather than in generally happening that becomes a concern and again you don't want to lose

all of the individuals who are staking it's very important again to try and keep as much of this decentralization as possible if everyone decides the only way that they can stake it if they go and give all their money to finance then we've lost aetherium too so we we cannot do that and it's very important that we keep building these newer solutions keep increasing the standard of key security one of the things I want to clarify you're describing specifically the attest and architecture for people who are still learning about how validator signing works and how attestations work Jim is using a custom design solution to have remote signers than to have a race

between multiple signers for everyone using stock software like the stock validator if you run the validator key on more than one machine it will result in a slashing unless you customize that so that there's flashier protection so basically if you run two servers with the same validator keys you will definitely be slashed unless you have a solution like Jim has developed with failover and redundancy so just make that absolutely true that said the the software is all available so the remote signing wallet runs inside prism so prism at the moment you can run with the remote key manager the remote

signing software is it's all available online so yeah although it is a it is so we say in advanced configuration there's certainly nothing stopping anyone from running exactly that configuration tomorrow if they say I am to use because maybe I have a misunderstanding here with with existing say Prismatic with existing prismatic you could configure to remote signers to so you're running the validator key on two machines to remote signers against one instance of the beacon chain and that's that's not a risk of being slashed for this configuration so if you

use that there was a something called the remote key manager so prism has the idea of key managers so I might just missed that entirely here so a key manager is basically a way of defining where keys have held and how they how they sign things the remote key manager in prism will talk to a remote signer there the remote sign look that we have built is called wallet D and that that has slashing protection built into it so what can happen there is you can run a prism mode with that particular key manager appointed your own instance of wallet D and it will use the keys on the wallet B rather than the keys on a local box because the slashing protection is

in place you can run multiple beacon nodes and validators using the same Keys as long as you are using the remote signer so again the thing with the remote signer is none of the keys the private keys are present on the validator on the beacon node they are only available on the remote signer so if you kind of want to think about it in general again you have to ensure and continue to ensure the validators private keys are only available in one place so in this case they're available on the remote signer and you can run as many validators against it as you like

because a private key still reside in only one location on the remote signer as a result of that they can easily protect because they can spot when an attestation might be slashing and they can deny it okay I think where I got hung up and I don't know if anyone else is missing that was missing the same thing you're running the validator service but that that machine doesn't necessarily hold the validator keys and so I was linking I was linking the validator service in the validator keys on the same machine but these are separate indistinct you're reinforcing that you can only hold the validator keys on one machine and that's yes and as we say you know this is thing it's

there are actually lots of different architectures that can be put in place and again you know that there there's a bunch of benefits or a bunch of drawbacks for doing this not least running multiple machines having to secure more machines and so again different configurations will suit for different people one of the other things that we as a community would would love to do I think is to have more or sample configurations to be able to say look you know if there's been a lot of talking how can we fit a very validator on our on a Raspberry Pi now there's there's been a lot of work done on that and actually now there's some great documentation out there people are very clear about what they can and can't do what their configuration is you know

make sure you have an SSD of this variety don't just just plug into to that port you so there's a lot of things out there where people have started to explain and provide that level of information which is fantastic as a community we probably need to build out a lot more of those to cover more different scenarios so the more of those that come down the line the easier it's going to be for people to say okay well I'm going to look for one that that fits my requirement and that will that will help them and as we said if that's going to be you know remote signers or distributed keys or whatever it may be that's great but again we you know as a community we do have to start building more and more of those out over the next

couple of months so that when we get to main net launch people can quite easily come in and say okay this kind of fits the I have certain requirements my architecture this kind of fits it I will use that it's going to be very very useful to to be able to do that rather than at the moment we have a lot of documentation that shows us how to install software vaguely talks about hardware requirements but doesn't really come at it from a stagers question of okay Here I am I have I know 96 teeth uh what do I do so more of that very very important that we can start doing that as much as possible but in all fairness I mean it's still alpha software even though it's been a development for a

long time I see so many people who are who feel frustrated that it's not not more highly engineered without recognizing that we're we're just now trying to take flight so these things take significant time to get right they do and and and I mean it's gonna be tricky because we we are doing the the traditional engineering run of it works for us let's move to the next stage there haven't been nice you eyes built I haven't been the focus and operational deployment security maintenance all of these things haven't been there now some of it you can argue is is not part of

the the client team's remit which is fair enough but it needs to be part of someone's remit because as we said if you know as soon as we get to the point where there's real money involved if someone puts a stake out there and it goes missing or they don't realize they need to be having their validator on immediately and they go away for a weekend and and you know loose money it's real money at that stage and it's gonna matter the people very very much so absolutely it's very very important but although we haven't done it yet and again it's been a moving target so fair enough we do need to start focusing on that pretty soon but it's so funny because I know I'm guessing a half percent of people will click through the

prompts as quickly as they can and submit their 32 ether deposit without having any idea what's going on or what the responsibilities become like they'll just want to get it in so I so certain those people exist I it's great you know if they want to throw six seven thousand dollars around like that okay you know but yeah but equally we you're right that we but we need to not have pages of warning saying make sure you do this don't do that make sure you do this instead we need to have automated systems that will actually check it beforehand and so that they're thinking we we need to have you know if you will fewer words and more actions so yeah I mean that and again that is

something that is certainly being worked on in a number of places and will continue to be worked on there down and it's definitely something that the more we can do the the better yeah so we're about to wrap up I have two programming notes if people have questions for you about intestine or or what are the things you're interested in answering questions about and and if there are questions you're not interested in answering what are the resources people should I mean I know I mean I know this like people asking me questions you know I don't I don't feel like answering that go go read so what are the questions you're interested in

answering and what are the resources that you would suggest for people who might find their own answers so I I am happy to field any questions obviously you know I I might point people at documents as a result or similar but I'm always happy to field questions it is a big space it's not a very well indexed space it can be very hard to kind of find the the information you need so we're always happy to get involved on our website you can get links to our discord our telegram I'm on Twitter I mean you know you can find us pretty easily so that there shouldn't be a problem in terms of resources it depends what level you're going in at

but certainly if I had to pick a single resource is worth tracking it's probably been edgington's you know we can etherium to news which is uh it's a newsletter it shows up on reddit you know it shows up on all the discards it's great it summarizes everything that's going on it's got great information in there Ben does a great job of summarizing and also humanizing an awful lot of the information out there so there's there's some great stuff there certainly that that would be a fantastic jumping-off point for anyone that wants to know not necessarily from scratch what's going on but how they can know what's happening this week what's happening next week what are the timelines what's change what's moving

around what new exciting things are coming down the pike all of those type of things very very useful that is about that would be my and these my go-to resource for keeping track of what's going on in the world of aetherium - all right Jim thank you so much for your time