Reevaluating Neuron Control Restrictions

[bjoernek]

@hpeebles

We could make every neuron have a permanent key which the controller can query for at any time (or maybe we’d need vetKeys so that the key never exists in the replica?) and which can be used when calling manage_neuron for any operation (it can’t be just for disburse for the reasons mentions in my previous post).

This way you can never fully trust a neuron which was previously owned by another user, destroying the demand for neuron markets.

This is an interesting idea, which I had not considered before.
As you pointed out, for security reasons one would definitely need to encrypt the permanent keys via vetKeys (or a similar mechanism) so that a single replica does not have access to them. I will discuss further with the crypto experts to get their feedback.

For the time being, I have one architecture feedback. If we were to implement such a key, (encrypted by vetKeys or a similar scheme), then it seems that the whole security of the NNS would be dependent on the applied encryption scheme.