Root Keys

Root keys are used to identify ownership of an account. An Algorand node only interacts with the public part of a root key (public keys or program bytecode).

Each account is controlled by a root authorization method, which also binds the account address to the authorization material:

• A single Ed25519 key pair. The public key of the root key is used directly as the account address;

• A multisignature composition of Ed25519 key pairs. The account address is derived by hashing the multisignature version, the authorization threshold, and all the participating public keys;

• A logic signature program, wholly in charge of a contract account. The account address is derived by hashing the program bytecode;

• A post-quantum scheme key pair. The account address is derived by hashing the scheme identifier, an address salt, and the public key, as specified in the Post-Quantum Signature section of the Ledger specification.

Regardless of the authorization method, root keys are used to authorize transaction messages as well as delegating the voting authentication using voting keys, unless that specific account was rekeyed. A rekeyed account would use the rekeyed key in lieu of the root key.

A relationship between a root key and voting keys is established when accounts register their participation in the agreement protocol.

For further details on the key registration (keyreg) process, refer to Ledger specification.