PROCESS/KEY-MANAGEMENT
sdk-v2/lab/process/KEY-MANAGEMENT.md · commit 96368332 · GLI CSR §2.2: §2.11 key management · ← package index · raw on GitHub ↗KEY & SECRET MANAGEMENT — RAIN RNG node (GLI-19 §3.3.2(b)(c); GLI CSR §2.11; UKGC RTS security 8.24; MGA Art. 18)
| Secret | Generated by | Where | Protection | Rotation | If leaked, an attacker can… |
|---|---|---|---|---|---|
houseSeed, chainSecret (per session, party B) |
randomBytes32() = OS CSPRNG via crypto.getRandomValues |
node store: file WAL wal.jsonl or Postgres sessions table, plaintext |
filesystem permissions / disk encryption / Postgres TDE + network ACL (operator control); process memory only during a round | every session (≤ 65 536 rounds, 90 % rotation) or ≤ 4 096 on-chain; never reused | predict hRev_k for that session — cannot bias or predict r_k without pRev_k (RNG-DESCRIPTION App. A Claim 2); removes the "independent parties" argument if the leaker also controls party A → mitigate with anchoring or a third-party node |
playerSeed, chainSecret (party A) |
randomBytes32() in RainRngClient, or wallet-signature-derived (docs/RNG.md §2.4) |
player/operator-server memory; wallet derivation is re-derivable, not stored | party A's own controls | per session | symmetric to the above |
| Operator signing key (ed25519 seed) | operator (openssl rand -hex 32 or KMS) |
RAIN_OPERATOR_KEY env / RAIN_OPERATOR_KEY_FILE (chmod 600, Docker/K8s secret) / RAIN_OPERATOR_KMS (KMS signer interface, no vendor impl shipped) |
never logged; public key published on GET / |
HOUSE-NODE §7 "Rotate the operator key" (overlap publish) | impersonate the operator's Terms//verify signatures — not part of the randomness; a client pinning the old key detects it |
| Anchoring key (EVM hot wallet) | operator | RAIN_ANCHOR_KEY |
gas-only balance | freely | spend gas; anchors are attributed by contract events, not signer |
sessionSeed, sessionId, chain roots, reveals |
derived | store + public after use | none needed (public commitments) | — | nothing (public) |
lab/FINGERPRINTS.json |
build | repository + deployed alongside the node (RAIN_FINGERPRINTS) |
integrity by git + lab copy | per release | replace the manifest to hide a tampered build → mitigated by the lab holding its own copy and RAIN_FINGERPRINTS_STRICT on a read-only mount |
Entropy source statement (GLI-19 §3.1.1 question): Node.js crypto.getRandomValues → OpenSSL RAND_bytes (CSPRNG re-seeded from the kernel: getrandom(2) on Linux). If the deployment uses a FIPS-validated OpenSSL provider, cite it in the hosting document; the code makes no FIPS claim.
Destruction: session secrets are not deleted after a session (they are needed for /verify and disputes) — they become public commitments once revealed; the WAL is append-only. Retention is governed by the operator's regulatory retention period (typically ≥ 5 years for game logs).
Same-operator caveat: when one entity runs both A and B, the seed of one "party" is available to the other's administrators; state it in the submission and deploy anchoring (RAIN_ANCHOR=1, RngAnchor.sol) or a Foundation-run B node (HOUSE-NODE §4).
← Back to the package index · Rendered 2026-09-14 09:34 UTC from the repository copy; the markdown in the zip / repo is the document of record.