Skip to main content
Fireblocks Key Link uses two types of external keys that you register in your workspace: validation keys and signing keys. Each key type supports a different set of algorithms. Validation keys accept a wider range of algorithms because they only certify signing keys and never sign transactions.

​
Validation keys

A validation key is a public key that you register with Fireblocks to certify your signing keys. When you add a new signing key, you submit a certificate for it that is signed by one of your validation keys. Fireblocks accepts the signing key only when that certificate validates against a validation key registered in your workspace.

​
Supported validation key algorithms

You can register a validation key that uses any of these algorithms:
  • RSA, with a key size of 2048 bits or larger
  • Elliptic Curve Digital Signature Algorithm (ECDSA) on the P-256 curve
  • ECDSA on the secp256k1 curve
  • Edwards-curve Digital Signature Algorithm (EdDSA) on the Ed25519 curve
Any supported validation key algorithm can sign a certificate for a signing key of either supported type. For example, an RSA validation key can certify both ECDSA secp256k1 and EdDSA Ed25519 signing keys.

​
Public key format

Submit the validation key’s public key as a PEM-encoded SubjectPublicKeyInfo structure. This format starts with the following header:
The Console rejects RSA public keys in the PKCS#1 format, which start with -----BEGIN RSA PUBLIC KEY-----. If your HSM exports RSA public keys in PKCS#1 format, convert the key before you register it. For example, with OpenSSL:

​
Expiration

Each validation key has an expiration period, set with the daysTillExpired parameter when you add the key. The minimum value is 1 day. After a validation key expires, you can no longer use it to certify new signing keys. Register a new validation key before the current one expires so you can keep adding signing keys. New validation keys require approval from your workspace’s admin quorum before they become active. For the request and response fields, see Add a new validation key.

​
Signing keys

A signing key is the key in your HSM or key management system that signs transactions for a vault account. Signing keys must use one of these algorithms:
  • ECDSA on the secp256k1 curve (ECDSA_SECP256K1)
  • EdDSA on the Ed25519 curve (EDDSA_ED25519)
The algorithm determines which blockchains the key can sign for. For the request fields, including the signed certificate (signedCertPem), see Add a new signing key.