session_keys: offline author_insertKey path for pre-#1739 node binaries - #153
Merged
Conversation
A stable2512 node cannot generate session keys against versi's post-#1739 runtime: the SessionKeys API changed v1->v2, so the node's v1 generate_session_keys call decodes wrong and traps (wasm unreachable), which TM's rotate RPC cannot work around. Add an offline path that bypasses that runtime API: derive the six SessionKeys from deterministic raw seeds, insert each into the node keystore via author_insertKey, and build the ownership proof offline - per-key signatures over the POP_-tagged stash account id, concatenated in SessionKeys order. sr25519/ed25519 sign the raw statement; the ecdsa/beefy key signs blake2_256(statement) via eth_keys (substrateinterface's ecdsa sign uses keccak). Raw seeds avoid substrateinterface's ecdsa derivation only accepting BIP44 paths, and the node derives the same key from the same 0x-seed SURI. Both registration flows fall back to this path when RPC rotation fails. Validated end-to-end: a post-#1739 runtime's set_keys accepts the offline proof (new test).
eduardspa
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A stable2512 node cannot generate session keys against versi's post-#1739 runtime: the SessionKeys API changed v1->v2, so the node's v1 generate_session_keys call decodes wrong and traps (wasm unreachable), which TM's rotate RPC cannot work around.
Add an offline path that bypasses that runtime API: derive the six SessionKeys from deterministic raw seeds, insert each into the node keystore via author_insertKey, and build the ownership proof offline - per-key signatures over the POP_-tagged stash account id, concatenated in SessionKeys order. sr25519/ed25519 sign the raw statement; the ecdsa/beefy key signs blake2_256(statement) via eth_keys (substrateinterface's ecdsa sign uses keccak). Raw seeds avoid substrateinterface's ecdsa derivation only accepting BIP44 paths, and the node derives the same key from the same 0x-seed SURI.
Both registration flows fall back to this path when RPC rotation fails. Validated end-to-end: a post-#1739 runtime's set_keys accepts the offline proof (new test).