TSS Node Deployment
Currently, the client can deploy the TSS Node on an off-the-shelf server, a server that supports Intel® Software Guard Extensions (Intel® SGX), or Apple MacBook. For more information, please refer to the “Deployment Methods” section in “TSS Node User Guide.”
This section uses an off-the-shelf server as an example. For more information on the SGX-ready physical server, please refer to the “Environment Preparation: SGX-Ready Server” section in “TSS Node User Guide.”
Environment Preparation
Minimum Requirements:
CPU: AMD64 or ARM64, 2 cores, a clock speed of 2.5 GHz
Memory: 4G
Hard disk: 64G SSD
Operating system: Ubuntu Server 20.04 LTS or above
Recommended Settings:
CPU: AMD64 or ARM64, 4 cores, a clock speed of 3.0 GHz
Memory: 8G
Hard disk: 128G SSD
Operating system: Ubuntu Server 20.04 LTS or above
Network Requirements:
No inbound connections are required
When the server is being installed or upgraded:
Able to access the apt sources of the system to install all necessary dependencies
Able to access the Docker Engine installation files to install the Docker Engine
Able to access docker.io registry (the public Docker registry)
Able to access the Intel website to download the driver (applicable to a SGX-ready server)
When the server is running:
Development environment: able to access port 443 of ws.tss.dev.cobo.com
Production environment: able to access port 443 of ws.tss.cobo.com
Able to access the callback server set up by the client
Access Requirements:
An account with sudo access
TSS Node Installation
Please contact the Cobo customer support to acquire a version of the TSS Node package that fits your server model and deployment method. The following takes the off-the-shelf server as an example.
Please check the SHA256 (256-bit) checksums to verify whether the TSS Node package is valid.
The SHA256 (256-bit) checksums must be the same as the file hash value. For example:
Once verified, please execute the following command to unzip the TSS Node package.
The following directory will be shown after you unzip the TSS Node package:
Please create a copy of cobo-tss-node-config.yaml.template and rename it as cobo-tss-node-config.yaml. You can then paste the new file under the configs directory. For more information, please refer to the “TSS Node Configuration Method” section in “TSS Node User Guide.”
Unless otherwise specified, all subsequent commands in this user guide should be executed under the root directory of the unzipped TSS Node package (e.g. the cobo-tss-node-generic path).
Please execute the following command to check whether all required dependencies and drives have been installed. If this is the first time that you install the TSS Node, the latest container images will also be pulled.
Output example:
By now, all dependencies are deemed as having been successfully configured and the TSS Node is ready for initialization.
TSS Node Initialization
Please execute the following command:
Output example:
During TSS Node initialization, the system will check whether Docker Engine has been successfully installed and build the container image; you'll be prompted to approve the auto installation of Docker Engine
You'll need to set a password to encrypt the secrets generated during TSS Node initialization; the disaster recovery process is required if you lost access or need to modify the password; you're recommended to set a complex password between 16-32 characters using a password manager (e.g. 1Password) and store the password on a secure device
The Node ID will be generated automatically (e.g. cobo73VA6C6WvofPg8tWYmqvdUF1cPYhd7EmGUxTexz5HCzYe) and serve as the unique identifier of the TSS Node. This Node ID will be used when you configure the TSS Node on Cobo Custody Web.
TSS Node Startup
Please execute the following command:
Output example:
Note:
If the TSS Node has not been configured on Cobo Custody Web, the TSS Node startup status will be returned as "failed.” You may, however, proceed with the subsequent steps first.
Once you have successfully configured the TSS Node on Cobo Custody Web, the startup status will be updated to the following:
You can press Ctrl+C to exit, and the TSS Node will continue to run on the backend.
To check the TSS Node status, please execute the following command:
To view container logs, please execute the following command:
You can press Ctrl+C to exit, and the TSS Node will continue to run on the backend.
To stop the TSS Node, please execute the following command:
TSS Node on Cobo Custody Web & MPC Root Extended Public Key Derivation
To configure/add the TSS Node on Cobo Custody Web, please refer to the following steps:
The client who has been granted the admin right can log in to Cobo Custody Web
Head to "MPC TSS Node" under "Settings" to add the TSS Node; the TSS Nodes managed by the other two parties must be kept online during this process
All three parties must jointly generate three MPC key shares, which will be stored locally in a distributed manner
The MPC root extended public key will also be generated, which can be used to derive all wallet addresses under this MPC wallet via BIP 32
MPC Key Share Management
The successfully generated MPC key shares will be encrypted and stored locally in the database file of the TSS Node package. The default path is db/secrets.db.
You are recommended to back up the database file and the password you've used to encrypt the database file when initializing the TSS Node. The two backup files should be stored in separate devices. For more information, please refer to “MPC Key Share User Guide.”
TSS Node Callback Mechanism
You can set up a callback mechanism for the TSS Node. Once the callback mechanism is successfully enabled, the TSS Node will send a request to the callback server upon receiving a task from the Cobo Custody backend. The TSS Node will execute the task only if it is approved by the callback server. For more information on TSS Node, please refer to “TSS Node User Guide.”
MPC Key Share Management
The successfully generated MPC key shares will be encrypted and stored locally in the database file of the TSS Node package. The default path is db/secrets.db.
You are recommended to back up the database file and the password you've used to encrypt the database file when initializing the TSS Node. The two backup files should be stored in separate devices. For more information, please refer to “MPC Key Share User Guide.”
TSS Node Callback Mechanism
You can set up a callback mechanism for the TSS Node. Once the callback mechanism is successfully enabled, the TSS Node will send a request to the callback server upon receiving a task from the Cobo Custody backend. The TSS Node will execute the task only if it is approved by the callback server. For more information on TSS Node, please refer to “TSS Node User Guide.”
Last updated
