What is the key_id in the SignWithECDSA request?

Developers
1

I am reviewing the threshold ECDSA documentation:

The key_id is a struct specifying both a curve and a name. The availability of a particular key_id depends on implementation.

What are the curves and names supported? Why would you want to pass something in?

2

The supported curve/name combinations are listed at the end of the ECDSA keys section of the documentation you linked to:

There are currently two master keys deployed, a test and a production key.

  • (secp256k1, test_key_1): the test key deployed on a single 13-node subnet.
  • (secp256k1, key_1) the production key deployed on two high-replication subnets, one activated for signing, and the other one for backing up the key for better key availability.

You need to pass a key_id to both sign_with_ecdsa and ecdsa_public_key to specify which ECDSA master key shall be used for the signing and/or key-derivation. The Internet Computer currently holds two ECDSA master keys for the secp256k1 curve and might potentially support more keys and/or curves in the future, and without passing a key_id it would not be clear which one to use. Also, different master keys may have different security properties, so by passing a key_id you specify which properties you want: for example, the (secp256k1, test_key_1) key is intended just for testing, while the (secp256k1, key_1) key is meant for production.

2 Likes