-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Release 1.5.15
https://bitbucket.org/JeanLucPicard/nxt/downloads/nxt-client-1.5.15.zipsha256:
474694e08ff2d9495aceff73a4ed9e276f4311d81695fd7eeaf94caba58d4764 nxt-client-1.5.15.zip
https://bitbucket.org/JeanLucPicard/nxt/downloads/nxt-client-1.5.15.jarsha256:
3ede181a73a365a54cd8341d0925d1ebe899382e0b9df808a83ab0e82feee5d2 nxt-client-1.5.15.jar
https://bitbucket.org/JeanLucPicard/nxt/downloads/nxt-client-1.5.15.exeThe exe and jar packages must have a digital signature by "Stichting NXT".
Change log:
Full offline transaction signing support.
The purpose of this security feature is to allow users to sign transactions
without ever entering their passphrase on a workstation connected to the
internet, thus avoiding the risk of having their passphrase stolen by locally
installed malware such as key loggers or copy/paste loggers, or malicious
plugins.
As a prerequisite to using this feature, users should setup two workstations:
(1) online with up to date blockchain, on which transactions will be prepared;
(2) offline with Java and NXT installed, but without internet connection, and
without needing to have up to date blockchain, on which transactions will be
signed.
The nxt.isOffline=true parameter can be used on the offline machine to make
sure it doesn't even try to connect to peers or to listen on the peer port.
In addition, users should prepare either a web camera to scan QR codes, or a
USB stick to copy data between the workstations.
The following procedure should be followed:
On the online workstation - users can create a transaction without entering
their passphrase. Click on the "advanced" link, check the "Do Not Broadcast"
option, and then check the newly added "Do Not Sign" option that appears.
When "Do Not Sign" is checked, the passphrase field is cleared and disabled.
If the account submitting the transaction does not yet have its public key
announced, a separate input field appears, to allow entering the public key.
In response, the server returns the unsigned transaction JSON, and in case
there are no message attachments to be encrypted, also the unsigned
transaction bytes.
The client now displays the "Raw Transaction Details" modal with the unsigned
transaction JSON, and the unsigned transaction bytes (including a QR code
representing them), if those exist.
The unsigned transaction bytes do not include the prunable attachments,
however they can still be used for signing the transaction, and also for
broadcasting the transaction in case no prunable attachments exist.
Users can transfer the unsigned transaction bytes to the offline workstation
by scanning the QR code, or download the unsigned transaction JSON to a file
by clicking the download icon, and transfer it using a USB stick to the
offline workstation.
On the offline workstation - users should use the "Transaction Operations"
modal, "Sign Transaction" tab, to sign the unsigned transaction JSON, which
can be uploaded from a file.
In response, a signature field is displayed, with a QR code, and also the
signed transaction JSON which users can save to a file for transferring back
to the online workstation.
Back on the online workstation, users can scan the signature QR code into the
"Raw Transaction Details" modal signature field, and broadcast the
transaction. Alternatively, they can use the "Broadcast Transaction" tab of
the "Transaction Operations" modal to broadcast the transaction JSON copied
from the offline workstation.
A command line tool, sign.sh, has been provided, for signing transaction JSON
without needing to even have an Nxt server or a browser running.
Note that when the transaction to be signed includes a message to be encrypted,
the encryption is also performed on the offline workstation. However, when
generating the unsigned transaction JSON on the online workstation, if using
a remote node, the plain text content of the message must be sent to this node
in order for it to prepare the transaction JSON. Therefore, use a local
installation when preparing encrypted messages for offline signing, if the
content of the message is sensitive.
All tabs in the "Transaction Operations" modal that have both bytes and json
input fields need to have only one of them filled. If in doubt, using the json
is preferred, as it will work for all transactions. The bytes format is still
accepted, when possible, for backwards compatibility, and for transferring
using QR codes (as the json cannot fit in a QR representation).
Other changes:
The signTransaction API now also returns the full signed transaction JSON.
The calculateFullHash API now also accepts unsignedTransactionJSON parameter.
Added getLastTrades and getLastExchanges API, accepting a multivalue asset,
respectively currencies parameter, and returning an array containing the last
trade or exchange for each of those assets or currencies.
Added fullHashToId utility API.
Display warning when trying to issue an asset or currency with less than 2
or more than 6 decimals.
Display total value of currencies owned on dashboard. Set default leasing
period to the maximum allowed (32767) in the UI. Other UI improvements.
Updated jetty to version 9.2.13. If unpacking on top of existing installation,
delete the lib subdirectory first.
-----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJVzbtBAAoJENqvaxkWiP4Z0foQAKfLOCOb7Hoem0sumRlWyvEX
D7jA/PeEW4TwqslP8wKSbj245hzadGLtEvugUAdAtf2oHRqFIGIOE3hOXPS5iuSd
Ofb95e9IRB+dwS9Pm/EjOqLf+TURoS5iCQgy7qEX/MZobWeDdUXM2Rq1+TPaKulk
4w8aYqNYD+jCyBTyOBp+lVbZPsiLTHmoHMmRlYjdERrv+ilQ1a2lRaqcMJTcFc3H
GrD1kEw9rD0U8NXG7lKpCT+APEUj/1SKI0OWV+3IBzfv9wCoGV7qzzPuZaE7En9G
UURi2lElVTAO21AkKPyycHtul7ZNUKh0zW41KMwMhuYZUiEJdhGjp0LSukHhWATg
UEHkjWU+78QjPX/8El+tewr7/fUy+UxerekvfyIVLjwBf6s05x7G3t7OyL5YH9+1
a9S/wQ+0rFCuUS5MB5dErJc6v9xuWSpj4aM7ELPSTX5PWpG+vs6DfrZkhcw6Pzec
mjP6lg6Z96PdbOfYsaQYma9JmdR+rr8j6xJwzI8XY0Du7nygLMpbRhiCUPyrwcw9
fdAvsGptimXrh03fCbCX+t0s3W+SO2rZXu0pokZKoApXsDxlUEm1ZMxwFi/103SV
+M1y/FRWWN5tB0YI3FXY8Dy+9enzocKUID77Xjkor/SnjF6uwJ5lnDNmjnpTEpk1
1TEKd68+ctKQ4HJtuzln
=tTB+
-----END PGP SIGNATURE-----
