Adjust Node.Counter for KES

With Vasil upgrade your node.counter for KES must be just one count higher than the last OpCertC value for your last block. If this value needs to be adjusted, this guide will show you how.

Did you know? "KES" stands for Key Evolving Signature

Welcome!

There are two method you can use to Rollback your node.counter. Please review and choose the method you prefer.

Good to know: This was created on July 2022 and process may change over time

Step 1 - Look up Operational Certificate Numbers

When it's time to update your KES you can run the following command on your block producer to confirm you have the correct Operational Certificate Numbers

Note path to node.cert and adjust if needed. Path in example is based off Coincashew guide for setting up a stake pool.

cardano-cli query kes-period-info --mainnet  \
  --op-cert-file $NODE_HOME/node.cert

Results should look similar to the following:

✓ The operational certificate counter agrees with the node protocol state counter
✓ Operational certificate's kes period is within the correct KES period interval
{
    "qKesNodeStateOperationalCertificateNumber": 4,
    "qKesCurrentKesPeriod": 505,
    "qKesOnDiskOperationalCertificateNumber": 5,
    "qKesRemainingSlotsInKesPeriod": 6832926,
    "qKesMaxKESEvolutions": 62,
    "qKesKesKeyExpiry": "2022-09-22T21:44:51Z",
    "qKesEndKesInterval": 558,
    "qKesStartKesInterval": 496,
    "qKesSlotsPerKesPeriod": 129600
}

This line is the Operational Certificate that your pool used to mint its last block "qKesNodeStateOperationalCertificateNumber": 4,

This line is the counter number of your current Operational Certificate: "qKesOnDiskOperationalCertificateNumber": 5,

If these number are NOT the same, as for the example above NodeState=4 and OnDisk=5 then you need to rollback your counter. In this case the node counter would need to be rolled back from 5 to 4 If, for example, NodeState and OnDisk =4, then you are all set and can proceed to renewing your KES following the normal procedure here.

Also If you have never made a block then you will need to rollback your counter to 0

Step 2 - Check current value of your node.counter

cat $HOME/cold-keys/node.counter

node.counter MUST be ONE greater than "qKesNodeStateOperationalCertificateNumber" value.

For example, "qKesNodeStateOperationalCertificateNumber": 4, So our node.counter should read "Next certificate issue number: 5"

If your "Next certificate issue number" is one higher you are all set and can continue to normal renew KES process found here.

Step 3 - KES Rollback

If you need to adjust your node.counter navigate to your node.counter file on your Air Gapped Machine.

In this example it is located in our home directory in a folder called: cold-keys. If your file is not located there please adjust file path.

cd $HOME/cold-keys/
cardano-cli node new-counter \
--cold-verification-key-file node.vkey \
--counter-value $((4 + 1)) \
--operational-certificate-issue-counter-file node.counter

Final Step

Now that your node.counter is adjusted you may proceed to renew your KES following the normal procedure here.

Congratulations you did it!

Contributors

Thanks to the following pools for helping to put together these guides. Please consider delegating to their pools to support them. Are you a pool? Consider buying them a coffee

Last updated