Implement ADR 034: Account Rekeying

docs/architecture/adr-032-change-pubkey.md

@@ -0,0 +1,81 @@
+# ADR 032: Change PubKey
+
+## Changelog
+
+- 30-09-2020: Initial Draft
+
+## Status
+
+Proposed
+
+## Context
+
+Currently, in the Cosmos SDK, the address of an auth account is always based on the hash of the public key.  Once an account is created, the public key for the account is set in stone, and cannot be changed.  This can be a problem for users, as key rotation is a useful security practice, but is not possible currently.  Furthermore, as multisigs are a type of pubkey, once a multisig for an account is set, it can not be updated.  This is problematic, as multisigs are often used by organizations or companies, who may need to change their set of multisig signers for internal reasons.
+
+Transferring all the assets of an account to a new account with the updated pubkey is not sufficient, because some "engagements" of an account are not easily transferable.  For example, in staking, to transfer bonded Atoms, an account would have to unbond all delegations and wait the three week unbonding period.  Even more significantly, for validator operators, ownership over a validator is not transferrable at all, meaning that the operator key for a validator can never be updated, leading to poor operational security for validators. 
+
+## Decision
+
+We propose the creation of a new standaonle module called `changepubkey` that is an extension to `auth` that allows accounts to update the public key associated with their account, while keeping the address the same.
+
+This is possible because the Cosmos SDK `StdAccount` stores the public key for an account in state, instead of making the assumption that the public key is included in the transaction (whether explicitly or implicitly through the signature) as in other blockchains such as Bitcoin and Ethereum.  Because the public key is stored on chain, it is okay for the public key to not hash to the address of an account, as the address is not pertinent to the signature checking process.
+
+To build this system, we design a new Msg type as follows:
+
+```protobuf
+message MsgChangePubKey {
+  bytes address = 1 [
+    (gogoproto.casttype) = "github.com/cosmos/cosmos-sdk/types.AccAddress"
+  ];
+  bytes pub_key = 2 [
+    (gogoproto.jsontag) = "public_key,omitempty", (gogoproto.moretags) = "yaml:\"public_key\""
+  ];
+}
+```
+
+As an example, account pubkey change message can be defined as follows.
+
+```json
+{
+    "type": "cosmos-sdk/StdTx",
+    "value": {
+        "address": "cosmos1wf5h7meplxu3sc6rk2agavkdsmlsen7rgsasxk",
+        "public_key": "cosmospub1addwnpepqdszcr95mrqqs8lw099aa9h8h906zmet22pmwe9vquzcgvnm93eqygufdlv"
+    },
+    "signature": "a9n7pIqCUuYJTCm7ZBv1cqqlM3uYyX/7SnaSXA8zrG0CBWP6p55pTFFHYn39tVvFtRbGE7gXF1qCiaOilJ8NtQ=="
+}
+```
+
+Here, the signature is signed for the public key thats current in-state for account `cosmos1wf5h7meplxu3sc6rk2agavkdsmlsen7rgsasxk`, as normally done in the ante-handler.
+
+Once, approved, the handler for this message type, which takes in the AccountKeeper, will update the in-state pubkey for the account and replace it with the pubkey from the Msg.
+
+Because an account can no longer be pruned from state once its pubkey has changed, we can charge an additional gas fee for this operation to compensate for this this externality (this bound gas amount is configured as parameter `PubKeyChangeCost`). The bonus gas is charged inside handler, using the `ConsumeGas` function.
+
+```go
+	amount := pk.GetParams(ctx).PubKeyChangeCost
+	ctx.GasMeter().ConsumeGas(amount, "pubkey change fee")
+```
+
+
+## Consequences
+
+### Positive
+
+* Will allow users and validator operators to employ better operational security practices with key rotation.
+* Will allow organizations or groups to easily change and add/remove multisig signers.
+
+### Negative
+
+Breaks the current assumed relationship between address and pubkeys as H(pubkey) = address. This has a couple of consequences.
+
+* We cannot prune accounts with 0 balance that have had their pubkey changed (we currently do not currently do this anyways, but the reason we have account numbers is presumably for this purpose).
+* This makes wallets that support this feature more complicated. For example, if an address on chain was updated, the corresponding key in the CLI wallet also needs to be updated.
+
+### Neutral
+
+* While the purpose of this is intended to allow the owner of an account to update to a new pubkey they own, this could technically also be used to transfer ownership of an account to a new owner.  For example, this could be use used to sell a staked position without unbonding or an account that has vesting tokens.  However, the friction of this is very high as this would essentially have to be done as a very specific OTC trade. Furthermore, additional constraints could be added to prevent accouns with Vesting tokens to use this feature.
+* Will require that PubKeys for an account are included in the genesis exports.
+
+## References
+

proto/cosmos/changepubkey/v1beta1/genesis.proto

@@ -0,0 +1,13 @@
+syntax = "proto3";
+package cosmos.changepubkey.v1beta1;
+
+import "gogoproto/gogo.proto";
+import "cosmos/changepubkey/v1beta1/params.proto";
+
+option go_package = "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/types";
+
+// GenesisState defines the auth module's genesis state.
+message GenesisState {
+  // params defines all the paramaters of the module.
+  Params params = 1 [(gogoproto.nullable) = false];
+}

proto/cosmos/changepubkey/v1beta1/params.proto

@@ -0,0 +1,12 @@
+syntax = "proto3";
+package cosmos.changepubkey.v1beta1;
+
+import "gogoproto/gogo.proto";
+
+option go_package = "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/types";
+
+// Params defines the parameters for the changepubkey module.
+message Params {
+  uint64 pubkey_change_cost = 1
+    [(gogoproto.customname) = "PubKeyChangeCost", (gogoproto.moretags) = "yaml:\"pubkey_change_cost\""];
+}

proto/cosmos/changepubkey/v1beta1/query.proto

@@ -0,0 +1,25 @@
+syntax = "proto3";
+package cosmos.changepubkey.v1beta1;
+
+import "gogoproto/gogo.proto";
+import "google/api/annotations.proto";
+import "cosmos/changepubkey/v1beta1/params.proto";
+
+option go_package = "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/types";
+
+// Query defines the gRPC querier service.
+service Query {
+  // Params queries all parameters.
+  rpc Params(QueryParamsRequest) returns (QueryParamsResponse) {
+    option (google.api.http).get = "/cosmos/changepubkey/v1beta1/params";
+  }
+}
+
+// QueryParamsRequest is the request type for the Query/Params RPC method.
+message QueryParamsRequest {}
+
+// QueryParamsResponse is the response type for the Query/Params RPC method.
+message QueryParamsResponse {
+  // params defines the parameters of the module.
+  Params params = 1 [(gogoproto.nullable) = false];
+}

proto/cosmos/changepubkey/v1beta1/tx.proto

@@ -0,0 +1,17 @@
+syntax = "proto3";
+package cosmos.changepubkey.v1beta1;
+
+import "gogoproto/gogo.proto";
+
+option go_package = "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/types";
+
+// MsgChangePubKey defines a message that enables changing a pubkey
+// of an account.
+message MsgChangePubKey {
+  bytes address = 1 [
+    (gogoproto.casttype) = "github.com/cosmos/cosmos-sdk/types.AccAddress"
+  ];
+  bytes pub_key = 2 [
+    (gogoproto.jsontag) = "public_key,omitempty", (gogoproto.moretags) = "yaml:\"public_key\""
+  ];
+}

simapp/_localsetup.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+rm -rf $HOME/.simd/
+
+cd $HOME
+
+simd init --chain-id=testing testing --home=$HOME/.simd
+simd keys add validator --keyring-backend=test --home=$HOME/.simd
+simd add-genesis-account $(simd keys show validator -a --keyring-backend=test --home=$HOME/.simd) 1000000000validatortoken,1000000000stake --home=$HOME/.simd
+simd gentx validator --keyring-backend=test --home=$HOME/.simd --chain-id testing
+simd collect-gentxs --home=$HOME/.simd
+
+simd start --home=$HOME/.simd

simapp/app.go

@@ -28,6 +28,9 @@ import (
 	"github.com/cosmos/cosmos-sdk/version"
 	"github.com/cosmos/cosmos-sdk/x/auth"
 	"github.com/cosmos/cosmos-sdk/x/auth/ante"
+	"github.com/cosmos/cosmos-sdk/x/auth/changepubkey"
+	changepubkeykeeper "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/keeper"
+	changepubkeytypes "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/types"
 	authrest "github.com/cosmos/cosmos-sdk/x/auth/client/rest"
 	authkeeper "github.com/cosmos/cosmos-sdk/x/auth/keeper"
 	authsims "github.com/cosmos/cosmos-sdk/x/auth/simulation"
@@ -97,6 +100,7 @@ var (
 	// and genesis verification.
 	ModuleBasics = module.NewBasicManager(
 		auth.AppModuleBasic{},
+		changepubkey.AppModuleBasic{},
 		genutil.AppModuleBasic{},
 		bank.AppModuleBasic{},
 		capability.AppModuleBasic{},
@@ -151,20 +155,21 @@ type SimApp struct {
 	memKeys map[string]*sdk.MemoryStoreKey
 
 	// keepers
-	AccountKeeper    authkeeper.AccountKeeper
-	BankKeeper       bankkeeper.Keeper
-	CapabilityKeeper *capabilitykeeper.Keeper
-	StakingKeeper    stakingkeeper.Keeper
-	SlashingKeeper   slashingkeeper.Keeper
-	MintKeeper       mintkeeper.Keeper
-	DistrKeeper      distrkeeper.Keeper
-	GovKeeper        govkeeper.Keeper
-	CrisisKeeper     crisiskeeper.Keeper
-	UpgradeKeeper    upgradekeeper.Keeper
-	ParamsKeeper     paramskeeper.Keeper
-	IBCKeeper        *ibckeeper.Keeper // IBC Keeper must be a pointer in the app, so we can SetRouter on it correctly
-	EvidenceKeeper   evidencekeeper.Keeper
-	TransferKeeper   ibctransferkeeper.Keeper
+	AccountKeeper      authkeeper.AccountKeeper
+	ChangePubKeyKeeper changepubkeykeeper.ChangePubKeyKeeper
+	BankKeeper         bankkeeper.Keeper
+	CapabilityKeeper   *capabilitykeeper.Keeper
+	StakingKeeper      stakingkeeper.Keeper
+	SlashingKeeper     slashingkeeper.Keeper
+	MintKeeper         mintkeeper.Keeper
+	DistrKeeper        distrkeeper.Keeper
+	GovKeeper          govkeeper.Keeper
+	CrisisKeeper       crisiskeeper.Keeper
+	UpgradeKeeper      upgradekeeper.Keeper
+	ParamsKeeper       paramskeeper.Keeper
+	IBCKeeper          *ibckeeper.Keeper // IBC Keeper must be a pointer in the app, so we can SetRouter on it correctly
+	EvidenceKeeper     evidencekeeper.Keeper
+	TransferKeeper     ibctransferkeeper.Keeper
 
 	// make scoped keepers public for test purposes
 	ScopedIBCKeeper      capabilitykeeper.ScopedKeeper
@@ -209,6 +214,7 @@ func NewSimApp(
 		minttypes.StoreKey, distrtypes.StoreKey, slashingtypes.StoreKey,
 		govtypes.StoreKey, paramstypes.StoreKey, ibchost.StoreKey, upgradetypes.StoreKey,
 		evidencetypes.StoreKey, ibctransfertypes.StoreKey, capabilitytypes.StoreKey,
+		changepubkeytypes.StoreKey,
 	)
 	tkeys := sdk.NewTransientStoreKeys(paramstypes.TStoreKey)
 	memKeys := sdk.NewMemoryStoreKeys(capabilitytypes.MemStoreKey)
@@ -241,6 +247,9 @@ func NewSimApp(
 	app.AccountKeeper = authkeeper.NewAccountKeeper(
 		appCodec, keys[authtypes.StoreKey], app.GetSubspace(authtypes.ModuleName), authtypes.ProtoBaseAccount, maccPerms,
 	)
+	app.ChangePubKeyKeeper = changepubkeykeeper.NewChangePubKeyKeeper(
+		appCodec, keys[changepubkeytypes.StoreKey], app.GetSubspace(changepubkeytypes.ModuleName),
+	)
 	app.BankKeeper = bankkeeper.NewBaseKeeper(
 		appCodec, keys[banktypes.StoreKey], app.AccountKeeper, app.GetSubspace(banktypes.ModuleName), app.BlockedAddrs(),
 	)
@@ -320,6 +329,7 @@ func NewSimApp(
 		),
 		auth.NewAppModule(appCodec, app.AccountKeeper, authsims.RandomGenesisAccounts),
 		vesting.NewAppModule(app.AccountKeeper, app.BankKeeper),
+		changepubkey.NewAppModule(app.AccountKeeper, app.ChangePubKeyKeeper),
 		bank.NewAppModule(appCodec, app.BankKeeper, app.AccountKeeper),
 		capability.NewAppModule(appCodec, *app.CapabilityKeeper),
 		crisis.NewAppModule(&app.CrisisKeeper),
@@ -351,7 +361,7 @@ func NewSimApp(
 	// so that other modules that want to create or claim capabilities afterwards in InitChain
 	// can do so safely.
 	app.mm.SetOrderInitGenesis(
-		capabilitytypes.ModuleName, authtypes.ModuleName, banktypes.ModuleName, distrtypes.ModuleName, stakingtypes.ModuleName,
+		capabilitytypes.ModuleName, authtypes.ModuleName, changepubkeytypes.ModuleName, banktypes.ModuleName, distrtypes.ModuleName, stakingtypes.ModuleName,
 		slashingtypes.ModuleName, govtypes.ModuleName, minttypes.ModuleName, crisistypes.ModuleName,
 		ibchost.ModuleName, genutiltypes.ModuleName, evidencetypes.ModuleName, ibctransfertypes.ModuleName,
 	)
@@ -576,6 +586,7 @@ func initParamsKeeper(appCodec codec.BinaryMarshaler, legacyAmino *codec.LegacyA
 	paramsKeeper := paramskeeper.NewKeeper(appCodec, legacyAmino, key, tkey)
 
 	paramsKeeper.Subspace(authtypes.ModuleName)
+	paramsKeeper.Subspace(changepubkeytypes.ModuleName)
 	paramsKeeper.Subspace(banktypes.ModuleName)
 	paramsKeeper.Subspace(stakingtypes.ModuleName)
 	paramsKeeper.Subspace(minttypes.ModuleName)

simapp/simd/cmd/root.go

@@ -27,6 +27,7 @@ import (
 	"github.com/cosmos/cosmos-sdk/simapp"
 	"github.com/cosmos/cosmos-sdk/store"
 	sdk "github.com/cosmos/cosmos-sdk/types"
+	changepubkeycmd "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/client/cli"
 	authclient "github.com/cosmos/cosmos-sdk/x/auth/client"
 	authcmd "github.com/cosmos/cosmos-sdk/x/auth/client/cli"
 	"github.com/cosmos/cosmos-sdk/x/auth/types"
@@ -124,6 +125,7 @@ func queryCommand() *cobra.Command {
 		rpc.BlockCommand(),
 		authcmd.QueryTxsByEventsCmd(),
 		authcmd.QueryTxCmd(),
+		changepubkeycmd.GetQueryCmd(),
 	)
 
 	simapp.ModuleBasics.AddQueryCommands(cmd)
@@ -152,6 +154,7 @@ func txCommand() *cobra.Command {
 		authcmd.GetDecodeCommand(),
 		flags.LineBreak,
 		vestingcli.GetTxCmd(),
+		changepubkeycmd.GetTxCmd(),
 	)
 
 	simapp.ModuleBasics.AddTxCommands(cmd)

std/codec.go

@@ -6,6 +6,7 @@ import (
 	cryptocodec "github.com/cosmos/cosmos-sdk/crypto/codec"
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	txtypes "github.com/cosmos/cosmos-sdk/types/tx"
+	changepubkey "github.com/cosmos/cosmos-sdk/x/auth/changepubkey/types"
 	vesting "github.com/cosmos/cosmos-sdk/x/auth/vesting/types"
 )
 
@@ -22,4 +23,5 @@ func RegisterInterfaces(interfaceRegistry types.InterfaceRegistry) {
 	txtypes.RegisterInterfaces(interfaceRegistry)
 	cryptocodec.RegisterInterfaces(interfaceRegistry)
 	vesting.RegisterInterfaces(interfaceRegistry)
+	changepubkey.RegisterInterfaces(interfaceRegistry)
 }