Using a Ledger Nano S with Dune

Installing the Dune Ledger app

To secure your Dune account, you should use a hardware wallet. Here, we show how to use the Ledger Nano S.

You will have to install the Dune application on the Ledger Nano S, once it has been setup. The Dune application will allow you to both sign manually some operations, and put the application in a baking-mode, where blocks and endorsements are automatically signed.

Installation from binary

This is currently the most easy way. You will need a Linux computer. If you are using another operating system, you should use the Tezos apps available in the Ledger Live application. It will provide the same features, in two different apps.

Go to https://dune.network/files/ledger-app-dune/nano-s/ and download the most recent version.

Use the tar command to unarchive the files. For example:

$ tar zxvf ledger-app-dune-nano-s-bin-2.0.1.20190624.tar.gz

Inside the directory, follow the steps within the README.md file to install the dependencies and use the correct scripts.

Normally, you will need to install the ledgerblue Python package (with the python-pip package on Debian):

$ sudo apt-get install python-pip
$ pip install --no-cache-dir ledgerblue

Then, inside the directory of the archive, just call the install.sh script:

$ ./install.sh

You will be asked to enter your PIN. If a previous version of the app was installed, you will also be asked to confirm its removal.

If you want to remove it, you can use the uninstall.sh script in the same way:

$ ./uninstall.sh

and you will be asked for your PIN and to confirm the removal of the app.

Installation from sources

You will need to install a fully configured Ledger SDK. The steps are described in the README file within the sources.

Clone the GIT repository https://gitlab.com/dune-network/ledger-app-dune

Use make load at the end to install the app.

Using the Dune Ledger app

The first thing to do is to plug the Ledger Nano S on a USB port of your computer, fill the PIN, and start the Dune app.

Now, in a terminal, use the dune-client to print the Ledgers that it can see:

$ dune-client list connected ledgers
## Ledger `unconscious-booby-impressive-gopher`
Found a Wallet 0.2.0 (Dune) 20190719 0c96bb04* (git-description: "0c96bb04*") application running on Ledger Nano S at [0001:0010:00].

To use keys at BIP32 path m/44'/1729'/0'/0' (default Dune key path), use one
of:
  dune-client import secret key ledger_user "ledger://unconscious-booby-impressive-gopher/ed25519/0'/0'"
  dune-client import secret key ledger_user "ledger://unconscious-booby-impressive-gopher/secp256k1/0'/0'"
  dune-client import secret key ledger_user "ledger://unconscious-booby-impressive-gopher/P-256/0'/0'"

If it cannot see the Ledger, it usually means that you didn’t start the Dune app on the Ledger.

The Dune client will extract the first key, and generate a uniq name for your Ledger. Here, it is unconscious-booby-impressive-gopher. It can be very useful if you have several Ledgers, it makes it easy to verify that you are using the correct one.

You can have as many addresses as you want generated from the Ledger, by just changing the last two numbers from the BIP32 path /44'/1729'/0'/0'.

For now, let’s record only the keyhash associated with the 0'/0' derivation:

$ dune-client import secret key ledger_user "ledger://unconscious-booby-impressive-gopher/ed25519/0'/0'"
Please validate (and write down) the public key hash displayed on the Ledger,
it should be equal
to `dn1HpmHxuu8q7AtKG7V5hBc7aKdKE1DreTtU`:
Dune address added: dn1HpmHxuu8q7AtKG7V5hBc7aKdKE1DreTtU
Key ledger_user registered

The client will wait for you to confirm on the Ledger that you can read the same key as displayed in the terminal. Then, a key ledger_user will be recorded in your client. You will then be able to use it for transfers and operations. Each time you will need to sign an operation for that key, the client will automatically ask the Ledger and you will have to enter your PIN.

If you need its public key, you can use:

$ dune-client show address ledger_user -S
Hash: dn1HpmHxuu8q7AtKG7V5hBc7aKdKE1DreTtU
Public Key: edpkty7aVXiWM3jKCV4v2d5WqSjRSscVeYoM7ZZfoXDtCsFNiuax7L
Secret Key: ledger://unconscious-booby-impressive-gopher/ed25519/0'/0'

As you can see, you cannot see the secret key: it is only stored on the Ledger Nano S. Remember to backup the 24 words that you used to initialize the Ledger, there is no other way to backup this secret key!

Installing the Tezos Ledger apps

Two Tezos apps for Ledger Nano S are available in Ledger Live, in the experimental section.

The two modes of the Dune app are available by using two apps:

  • A Tezos Wallet app, for most operations, except baking

  • A Tezos Baking app, only for baking

Both should work with Dune as they do with Tezos, with the following differences:

  • the Tezos app will display the addresses as tzXXX addresses instead of dnXXX addresses. You may use dune-client dune print key hashes tzXXX to check the correspondance;

  • you can only setup one key for baking. This should not be a limitation for most people;