Open
Conversation
* Also add a "sign_hex" command to sign non-printable data. * Include unit tests for external signing support functions. * Because this is a significant change, and this project is not updated often, increment the version number. * Resolves ripple#48
legleux
approved these changes
Jul 30, 2025
Collaborator
legleux
left a comment
There was a problem hiding this comment.
This is pretty cool and seems very useful!
* upstream/master: Update rippled version and remove reference to Ripple's defunct Conan recipies. (58)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change, if merged, adds support for external signing tools, such as an HSM (Hardware Security Module).
Additionally:
Outline of steps to use this new functionality:
One-time setup
rippledformat (e.g.nHBQi...), hex encoded, or base-64 encoded. Either way, the key must be 33 bytes decoded, and the first byte must be0xEDfor aned25519key, and0x02or0x03for asecp256k1key.validator-keys create_external <encoded_public_key>Usage
validator-keys start_token. This will return a hex encoded string to sign.validator-keys finish_token <encoded_signature>rippled.cfgfile just as if it was generated withcreate_token.The steps to revoke a key are identical to the Usage steps, except using the
start_revoke_keysandfinish_revoke_keyscommands.For testing, if you don't have an HSM handy, you can accomplish the same thing in Usage step 2 using
validator-keys --keyfile <path to a key file generated with create_keys> sign_hex <partial token output from Usage step 1>