<p>The pool keys control the pool and can never be changed. If your pool keys are exposed, then you have lost control of your pool (this doesn't necessarily mean your pledge, but control of the fees, where the rewards go, the deposit, etc.).</p>
<p>If you create these keys on an online machine there is increased risk of the keys being exposed, for example from things like:</p>
<ul>
<li>Running malicious software (think about how much code written by strangers you run on your machine - software, games, etc.)</li>
<li>Being included in backups left around on drives/USB sticks or uploaded to the cloud</li>
</ul>
<p>You may consider these risks small, but they're risks all the same. You only have to expose your keys <em>once</em> for it to be game over for your pool.</p>
<p>Given these keys don't <em>need</em> to be on a connected machine, it therefore seems sensible to create them on a machine that is never connected to the internet. It <em>massively</em> reduces the risk.</p>

CC BY-SA 4.0
2021-07-15T13:18:04.233Z
Thanks, okay, so only I have physical access to these VHDs, fresh installs from truster hashed media. Therefore I am comfortable with creating the secrets on a USB mount within the BP and destroying the USB after preserving what I need. Thank you!
Louis Waweru
CC BY-SA 4.0
2021-07-15T18:08:26.520Z
That doesn't sound unreasonable to me. Just be sure that you have good secure backups. You don't want to lose your pool because of something simple like a drive failure. I also keep an off-site backup of important keys.. if my house burned down I wouldn't want to lose access to funds at a time it might be most useful! GL with the pool!
Danny Tuppeny - CODER
CC BY-SA 4.0
2021-07-15T18:13:08.740Z
I highly recommend storing your pool keys on a hardware wallet.
Marek Mahut - StakeNuts
CC BY-SA 4.0
2021-07-15T18:14:50.503Z
Good point - though this is only possible for new pools (where the hardware wallet generates the key). Unfortunately not possible to migrate an existing pool to a hardware wallet because as noted above, the keys cannot be replaced.
Danny Tuppeny - CODER
CC BY-SA 4.0
2021-07-15T18:33:59.163Z
@MarekMahut-StakeNuts I happen to have two, Valentine’s Day sale. But I’m a bigger fan of VMs doing a single thing before they are secured and stored away. I am very disappointed with it’s my Ledger purchase. It’s a constant Unicode link spam bombardment combined with Twilio phishing. The efforts wasted on me make me wonder if something like ERM data leaked. Fun fact, Dadalus VMs all take nearly zero bytes after the first. Go ReFS and deduplication. It’s no fun losing a HW wallet, since they cost money, but my VMs are my truly secure wallets. Thank you for the good advice though. I agree
Louis Waweru
CC BY-SA 4.0
2021-07-15T12:50:38.923Z
2021-07-15T12:50:38.923Z
Danny Tuppeny - CODER
<p>I am trying to understand the extreme caution about creating secrets for the BP node.</p>
<p>Is the concern about not knowing what one might lease in the cloud, or how security is in such a company, or their retainment proceeders, or multiplexing protocols, or is it about the software we're building to run the node?</p>
<p>Some cases, air gapping seems silly and I can imagine people outputting these secrets into their DropBox or OneDrive, etc.</p>
<p>If I run my own cluster, I really do not have to airgap right? I can simply mount a tempfs over USB, or any other number of solutions.</p>
<p>Just trying to clear this up.</p>
<p>Where does the cause for concern mainly originate?</p>

<staking><cardano-node><security><block-production>
Airgapping Concerns for Block Producer Secrets
# Airgapping Concerns for Block Producer Secrets

(Asked by: username_0 on 2021-07-15)

I am trying to understand the extreme caution about creating secrets for the BP node.

Is the concern about not knowing what one might lease in the cloud, or how security is in such a company, or their retainment proceeders, or multiplexing protocols, or is it about the software we're building to run the node?

Some cases, air gapping seems silly and I can imagine people outputting these secrets into their DropBox or OneDrive, etc.

If I run my own cluster, I really do not have to airgap right? I can simply mount a tempfs over USB, or any other number of solutions.

Just trying to clear this up.

Where does the cause for concern mainly originate?

**Tags:** staking, cardano-node, security, block-production

---

## 1 answers

### Answer by username_1 on 2021-07-15. Score: 3 | Accepted answer

The pool keys control the pool and can never be changed. If your pool keys are exposed, then you have lost control of your pool (this doesn't necessarily mean your pledge, but control of the fees, where the rewards go, the deposit, etc.).

If you create these keys on an online machine there is increased risk of the keys being exposed, for example from things like:

* Running malicious software (think about how much code written by strangers you run on your machine - software, games, etc.)
* Being included in backups left around on drives/USB sticks or uploaded to the cloud

You may consider these risks small, but they're risks all the same. You only have to expose your keys *once* for it to be game over for your pool.

Given these keys don't *need* to be on a connected machine, it therefore seems sensible to create them on a machine that is never connected to the internet. It *massively* reduces the risk.

> **Comments:**
> **username_0**: Thanks, okay, so only I have physical access to these VHDs, fresh installs from truster hashed media. Therefore I am comfortable with creating the secrets on a USB mount within the BP and destroying the USB after preserving what I need. Thank you!  
> **username_1**: That doesn't sound unreasonable to me. Just be sure that you have good secure backups. You don't want to lose your pool because of something simple like a drive failure. I also keep an off-site backup of important keys.. if my house burned down I wouldn't want to lose access to funds at a time it might be most useful! GL with the pool!  
> **username_2**: I highly recommend storing your pool keys on a hardware wallet.  
> **username_1**: Good point - though this is only possible for new pools (where the hardware wallet generates the key). Unfortunately not possible to migrate an existing pool to a hardware wallet because as noted above, the keys cannot be replaced.  
> **username_0**: @MarekMahut-StakeNuts I happen to have two, Valentine’s Day sale. But I’m a bigger fan of VMs doing a single thing before they are secured and stored away. I am very disappointed with it’s my Ledger purchase. It’s a constant Unicode link spam bombardment combined with Twilio phishing. The efforts wasted on me make me wonder if something like ERM data leaked. Fun fact, Dadalus VMs all take nearly zero bytes after the first. Go ReFS and deduplication. It’s no fun losing a HW wallet, since they cost money, but my VMs are my truly secure wallets. Thank you for the good advice though. I agree  

---

