[backport] Document session signing keys - #1155
Open
JoaoSa-da wants to merge 4 commits into
Open
Conversation
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Signed-off-by: Joao Sa <joao.sousa@digitalasset.com>
Signed-off-by: Joao Sa <joao.sousa@digitalasset.com>
JoaoSa-da
force-pushed
the
i31838-port-session-signing-key-doc-changes
branch
from
July 28, 2026 08:02
7ac8ad3 to
64a50b3
Compare
thibault-da
approved these changes
Jul 31, 2026
thibault-da
left a comment
thibault-da
left a comment
Contributor
There was a problem hiding this comment.
Few minor comments but LGTM thanks!
| ``` | ||
|
|
||
| Please note that **session signing keys** are only used with an external KMS (Key Management Service) provider. | ||
| Please note that **session signing keys** are only used with an [external KMS (Key Management Service) provider](/global-synchronizer/production-operations/kms-operations#enable-external-key-storage-with-a-kms) and are already disabled by default. |
Contributor
There was a problem hiding this comment.
Suggested change
| Please note that **session signing keys** are only used with an [external KMS (Key Management Service) provider](/global-synchronizer/production-operations/kms-operations#enable-external-key-storage-with-a-kms) and are already disabled by default. | |
| Please note that **session signing keys** are only used with an [external KMS (Key Management Service) provider](/global-synchronizer/production-operations/kms-operations#enable-external-key-storage-with-a-kms) and are disabled by default. |
| Extending the lifetime of session keys minimizes the need for repeated key negotiation or remote signing—but it also increases the window during which keys are stored in memory, raising the risk of compromise. | ||
| Currently, **session encryption keys are enabled by default**, whereas **session signing keys**, being directly tied to | ||
| a KMS, are **disabled by default**. However, the latter can be enabled when using an external KMS to store private keys | ||
| via a configuration parameter. |
Contributor
There was a problem hiding this comment.
Would be nice to either say what the config parameter is here or link to where it;s documented
|
|
||
| 1. ``keyValidityDuration > defaultMaxSequencingTimeOffset`` | ||
| 2. ``keyValidityDuration > setBalanceRequestSubmissionWindowSize`` | ||
| 3. ``keyValidityDuration > confirmationResponseTimeout + mediatorReactionTimeout`` |
Contributor
There was a problem hiding this comment.
Might be worth re-iterating where to find more info about mediatorReactionTimeout etc here. A link to the dynamic sync params page like you did above is fine
| #### Configurable parameters | ||
|
|
||
| Session signing keys have a validity period associated with them every time they are created, and they are only valid | ||
| during that period. This period can be adapted through Canton's configuration files. This section lists the |
Contributor
There was a problem hiding this comment.
Give at least one an example of the full canton config path where the fields below must be set, like
canton.participants.<participant_name>.crypto....
| configurable parameters, what they control, and what to keep in mind when modifying them. Throughout this section | ||
| ``ts`` denotes the timestamp at which we are signing. | ||
|
|
||
| - **enabled** |
Contributor
There was a problem hiding this comment.
Doesn' t look like the ** show up in bold in the preview
Using "``" is probably better anyway
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport #31838 with documentation that was included in the old docs but missing from the new ones.