# Generation of Schnorr production keys and II subnet downtime **URL:** \ **Category:** Developers\ **Tags:** Governance, internet-identity\ **Created:** [August 2, 2024, 7:31pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829 "2024-08-02T19:31:30Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![andrea](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@andrea](https://forum.dfinity.org/u/andrea)\ **Post date:** [August 2, 2024, 7:31pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/1 "2024-08-02T19:31:30Z")
In the past weeks we proposed to generate test keys for Schnorr-BIP340 and Ed25519 on subnets `2fq7c` and `fuqsr`. This allowed us to perform various tests, including the end-2-end key generation and xnet resharing protocols on mainnet. As this testing phase of threshold Schnorr is now concluded, we propose to move to the next phase and generate the “production” keys on mainnet on the fiduciary subnet `pzp6e`, which also holds the production ECDSA key. If proposal [131474](https://dashboard.internetcomputer.org/proposal/131474) is accepted, the subnet will generate one BIP340 key and one Ed25519 key with key ID `key_1`. A crucial step of releasing the production keys is to make sure they are also backed up in at least one other subnet. For the Schnorr keys, we are proposing to back them up on subnet `uzr34`, which has the same size as the fiduciary subnet and serves as backup subnet of the ECDSA production key. Note that the key backup process requires the backup subnet to pause while the key is being reshared. Since the proposed backup subnet hosts the II canister smart contract, this will not process new messages while the backup is in progress. As this process is not yet fully automated, it requires 3 NNS proposals to be submitted, voted on, and executed in sequence. The result is downtime for the II subnet, estimated to be between 6-10 minutes. We acknowledge this is less than ideal and will have some user-facing impact on apps that rely on II. However, this will not affect open sessions on dapps using II; only new sessions will be impacted. If proposal 131474 were successful, DFINITY would plan to initiate the backup process at 10 AM CEST (8AM UTC) on Tuesday 6th of August. ---
**Author:** ![diegop](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/diegop/32/569_2.png) [@diegop](https://forum.dfinity.org/u/diegop)\ **Post date:** [August 2, 2024, 8:13pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/2 "2024-08-02T20:13:45Z")
---
**Author:** ![Trils](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/trils/32/17579_2.png) [@Trils](https://forum.dfinity.org/u/Trils)\ **Post date:** [August 3, 2024, 9:33am UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/3 "2024-08-03T09:33:37Z")
Is there no backup/replicated NNS canister that would failover if the main NNS canister is down for maintenance/updates? Maybe i’m thinking in traditional IT terms but important hardware always as a failover and syncs when the main one gets back up… ---
**Author:** ![dfisher](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dfisher](https://forum.dfinity.org/u/dfisher)\ **Post date:** [August 3, 2024, 9:59am UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/4 "2024-08-03T09:59:55Z")
Might be worth putting up something to alert users during that 10 minute window that there’s nothing wrong going on ---
**Author:** ![timk11](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/timk11/32/9489_2.png) [@timk11](https://forum.dfinity.org/u/timk11)\ **Post date:** [August 4, 2024, 9:28am UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/5 "2024-08-04T09:28:18Z")
Can you add UTC time to the banner? ---
**Author:** ![andrea](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@andrea](https://forum.dfinity.org/u/andrea)\ **Post date:** [August 5, 2024, 12:55pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/6 "2024-08-05T12:55:40Z")
> [@Trils](#): > > Is there no backup/replicated NNS canister that would failover if the main NNS canister is down for maintenance/updates? All canisters are replicated in all nodes of the same subnets, but not on other subnets by default. I am guessing this kind of replication can be done almost entirely on the application layer, however automatically redirecting users to other canisters may not be necessarily trivial. ---
**Author:** ![andrea](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@andrea](https://forum.dfinity.org/u/andrea)\ **Post date:** [August 5, 2024, 12:56pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/7 "2024-08-05T12:56:15Z")
> [@timk11](#): > > Can you add UTC time to the banner? I updated the post, so it should also be reflected on the banner now. ---
**Author:** ![andrea](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@andrea](https://forum.dfinity.org/u/andrea)\ **Post date:** [August 6, 2024, 9:56am UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/8 "2024-08-06T09:56:27Z")
UPDATE: The resharing of Schnorr keys from the `pzp6e` subnet to the `uzr34` subnet was successful. The three proposals used in the process were [131506](https://dashboard.internetcomputer.org/proposal/131506), [131510](https://dashboard.internetcomputer.org/proposal/131510), [131511](https://dashboard.internetcomputer.org/proposal/131511). After the last proposal was executed the subnet restarted operating normally. The total downtime of the subnet was of about 11 minutes. ---
**Author:** ![lastmjs](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/lastmjs/32/3406_2.png) [@lastmjs](https://forum.dfinity.org/u/lastmjs)\ **Post date:** [August 6, 2024, 11:21am UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/9 "2024-08-06T11:21:39Z")
So…tSchnorr is production-ready and live? ---
**Author:** ![andrea](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@andrea](https://forum.dfinity.org/u/andrea)\ **Post date:** [August 6, 2024, 12:15pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/10 "2024-08-06T12:15:10Z")
Almost, keys have been generated and backed up. We are planning to submit a proposal to enable signing later this week. ---
**Author:** ![dfisher](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dfisher](https://forum.dfinity.org/u/dfisher)\ **Post date:** [August 6, 2024, 2:18pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/11 "2024-08-06T14:18:05Z")
Assume there’ll be a big marketing push once it’s out !!! Congrats guys ---
**Author:** ![diegop](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/diegop/32/569_2.png) [@diegop](https://forum.dfinity.org/u/diegop)\ **Post date:** [August 6, 2024, 4:42pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/12 "2024-08-06T16:42:50Z")
---
**Author:** ![lastmjs](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/lastmjs/32/3406_2.png) [@lastmjs](https://forum.dfinity.org/u/lastmjs)\ **Post date:** [August 13, 2024, 1:13pm UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/13 "2024-08-13T13:13:42Z")
Is it out now? Production keys live and operational? ---
**Author:** ![Lorimer](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/lorimer/32/17601_2.png) [@Lorimer](https://forum.dfinity.org/u/Lorimer)\ **Post date:** [August 14, 2024, 6:00am UTC](https://forum.dfinity.org/t/generation-of-schnorr-production-keys-and-ii-subnet-downtime/33829/14 "2024-08-14T06:00:20Z")
Only one of the new keys has been enabled so far. More info here → [Subnet Management - pzp6e (Fiduciary) - #7 by Lorimer](https://forum.dfinity.org/t/subnet-management-pzp6e-fiduciary/33664/7)