Node Key

Overview

A node key authenticates a node during peer-to-peer communication. The node proves possession of the private key as part of a secure handshake, and peers derive or verify the associated Node Identity. This prevents an attacker from simply claiming a trusted peer ID without controlling the corresponding secret.

Node keys should be separated from Account Keys and validator signing keys. Each key protects a different authority: networking identity, asset control, or consensus participation. Separation limits the damage from compromise and allows networking credentials to rotate without moving funds or changing validator authority. Some client software generates the node key automatically during initialization.

Loss of the key may cause the node to appear as a new peer, invalidating static peer records, allowlists, or reputation. Unauthorized copying can create duplicate identities operating from different locations, which may confuse monitoring and weaken trust. Files containing node keys therefore need restrictive permissions, secure backup decisions, and protection during image creation or server cloning.

Rotation should update every dependent peer configuration and monitoring system. Operators should verify the new public identifier before deployment and prevent simultaneous unintended use of old and new instances. A node key does not prove that the node is synchronized, honest, or running approved software; it only proves continuity and control of the cryptographic identity used for network communication.

Reliable use of Node Key requires evidence that can be independently checked. a node key authenticates peer identity and should be isolated from keys that control funds, validation, or administrative authority. For Node Key, the implementation should preserve the network context and raw records behind any security, settlement, or compatibility decision.