This guide will cover FLOT verifying and signing workflow.
Cointoolkit can be used for other ends, but should at least be used by shareholders to verify FLOT addresses, transactions and signatures.
It have numerous advantages to working directly with the command line, like known key verification, multi signature signed counter, transaction verification, works in any device with a browser, no need to be on 24x7, etc.
This guide is valid for NuBits, NuShares, Peercoin, Bitcoin, BlockShares and BlockCredits, and the steps will be exactly the same. Just make sure you have selected the mode you want to work in, on the dropdown at the top right of the page.
Remember that this application can be used offline for enhanced security, and that the live version at http://ttutdxh-nubits.github.io/cointoolkit/ is loading directly from https://github.com/ttutdxh-nubits/cointoolkit, so no changes can be made to the code without being reflected in GitHub. Everyone can check the code and be sure what the code is doing to your data.
Using it as a offline solution is specially secure working with QR data between you online device and your offline verifying and signing device.
Creation of your keys
Note: If you already have created a address/pubkey in the desktop wallet you can "dumpprivkey {address}"
in the console to get your WIF, then paste it in Verify page to get all the details and skip this step.
Navigate to the New Address page. You have a few options to create the private key/pubkey/address.
-
Generate from a Seed or Brainwallet: This allows you to use a password as your private key, allowing you to memorize it and be available without the need of having the private key at hand.
Check the box “Custom Seed or Brainwallet” and enter your unique password, then click generate.
Repeat this step a few times to be sure that the keys match and you are entering your password correctly.
Remember that you can use the same password/seed in multiple modes (like NBT, NSR and BTC) and you will get a correspondent address for each mode, allowing you to only remember one.
Warning: Brainwallets are as secure as the seed.
Attackers are professionals, continually trying to guess people passwords, and they are pretty good at it.
They brute force numbers, dates, word lists, and even quotes or book texts!
You will be robbed if you use anything that is written on the internet. Only use >12 random words like “result result quit crew tiny potato frost apple rib puppy federal sausage absent”, or totally random strings like: "Th\sI33AReallyL==ngRa`nnnd$mAndS*c4reBr[inWal!etSeed!"
Bonus tip: Add your email address at the end of the seed to make it extra secure, so attackers will have to explicitly target you instead of just crack it out of thin air.
-
Click generate with the default options: This will create a random key, so you will have to store/correctly backup the Private key in order to use it later.
You can calculate the public key and address of your private key later. Paste your private key in the Verify page and click “Verify” to calculate them.
You now have your keys/address ready to receive and send funds from that address.
Creation of the multi signature address
Navigate to the New Multisig Address page and you will see empty rows where you can add each signer public keys.
Known public keys identities will be shown in the gray box next to the public key.
Current FLOT members public keys are known by the application and can be added clicking on the “Need a Mediator?” button. You can then select the FLOT member from the mediator dropdown and select add public key to add the corresponding public key to the list.
When you are done selecting the signers select the amount of signatures required to release the coins and click on Submit.
Warning: Altering the order of the public keys results in different addresses, so it is recommended to order them lexicographically to avoid mistakes.
An address and a redeem script will be generated, which is necessary to spend from that address.
Ideally you should share the shareable url, so other people can verify the address belongs to FLOT members.
The group is now ready to receive funds.
This is the first NBT address created by FLOT (click to verify): BqyRzFtWXDmjxrYpyJD42MLE5xc8FrB4js
Creating a transaction
Only one of the FLOT members will have to create the transaction. If you have received the transaction you must continue to the next step.
Navigate to the New Transaction page and you will see a field to input an address, WIF key or the previously created redeem script.
In this case, since is a multisig address, you will have to input the redeem script created in the previous section and click “Load”.
All the unspent outputs of the address will be loaded under the “Inputs” tab, where you can review and delete unnecessary ones.
Now go to “Outputs” tab and enter the receiving address, the change address (should be the same multisig address from where the funds are being spent, so the change comes back to the same group control) and the amounts.
Warning: The remaining amount not sent to the change address will be used as a transaction fee.
Click generate and you will get a hex encoded transaction that you can share or save for the next step.
Transaction verifying
This step and the signing step are crucial since they will dictate where is the money being sent, and equally critical, what funds are being spent.
Navigate to the Verify page where you can paste the transaction or load it from a QR Code, then click “Verify” and carefully examine and cross-reference what the transaction is doing.
If you find any discrepancy, alert immediately the rest of the members.
When you have verified the transaction, click on the blue button “Continue to sign” to copy it over to the Sign page.
In the Verify page you can verify transactions, redeem scripts, pubic keys and private keys
Private keys must be in WIF format! To verify hex private keys go to New Address page and use the hex key under “Custom seed”. Be sure to check the box “This is a 64 char hex private key”, else it will be handled like a brainwallet seed!
Transaction signing
Do not sign transactions that you haven’t verified in the previous step.
Copy the verified transaction from the Verify page to the Sign page. Insert your private key corresponding to that transaction and you will get your signed transaction.
You can now repeat the Transaction verifying step with the signed transaction, to see if it has been correctly signed. If everything is fine you can then share the link at the bottom on “Shareable verification link” to let the next signer continue with the request.
Hope this guide and Cointoolkit is useful to you, if it is, please consider donating! Thanks!