The Key Running a Dusk Provisioner Does Not Have to Own the Stake
Compromising a provisioner server does not have to give an attacker withdrawal authority over the DUSK behind it.
Dusk staking separates two roles. The Consensus Key is the online credential used by the node to vote and sign blocks. The Owner Key controls unstaking and withdrawing the stake. If no owner is specified, the consensus key becomes the owner by default. But Dusk also supports rusk-wallet stake --owner <OWNER_ADDRESS> to separate them.
That changes the security boundary of a provisioner.
The node needs consensus.keys to participate in consensus; it does not need the owner wallet sitting beside it. Dusk’s current operator guidance explicitly recommends keeping the owner wallet and recovery material off the node.
So an operator can treat the Consensus Key as a hot operational credential without automatically giving that hot environment the ability to exit with the capital.
The separation is not absolute protection. A stolen Consensus Key can still sign conflicting or otherwise invalid consensus messages, and Dusk’s hard penalties can burn stake for that behavior.
The practical decision therefore happens before staking: using the default configuration combines consensus authority and capital-control authority; specifying a separate owner narrows what a compromised validator host can directly do.
@Dusk $DUSK #dusk
Compromising a provisioner server does not have to give an attacker withdrawal authority over the DUSK behind it.
Dusk staking separates two roles. The Consensus Key is the online credential used by the node to vote and sign blocks. The Owner Key controls unstaking and withdrawing the stake. If no owner is specified, the consensus key becomes the owner by default. But Dusk also supports rusk-wallet stake --owner <OWNER_ADDRESS> to separate them.
That changes the security boundary of a provisioner.
The node needs consensus.keys to participate in consensus; it does not need the owner wallet sitting beside it. Dusk’s current operator guidance explicitly recommends keeping the owner wallet and recovery material off the node.
So an operator can treat the Consensus Key as a hot operational credential without automatically giving that hot environment the ability to exit with the capital.
The separation is not absolute protection. A stolen Consensus Key can still sign conflicting or otherwise invalid consensus messages, and Dusk’s hard penalties can burn stake for that behavior.
The practical decision therefore happens before staking: using the default configuration combines consensus authority and capital-control authority; specifying a separate owner narrows what a compromised validator host can directly do.
@Dusk $DUSK #dusk
