Root Keys

Root keys are used to identify ownership of an account. An Algorand node only interacts with the public part of a root key (public keys or program bytecode).

An account is controlled by one of the following root authorization methods, which also bind the account address to the authorization material:

• A single Ed25519 key pair. The public key of the root key is used directly as the account address;

• A multisignature composition of Ed25519 key pairs. The account address is derived by hashing the multisignature version, the authorization threshold, and all the participating public keys;

• A logic signature program, wholly in charge of a contract account. The account address is derived by hashing the program bytecode;

• A post-quantum scheme key pair. The account address is derived by hashing the scheme identifier, an address salt, and the public key.

Note

Application accounts are the exception: their address is the hash of the Application ID (prefixed by appID), which binds no authorization material. No root key exists for these accounts: unless rekeyed, they are controlled exclusively by their Application through inner transactions.

An account’s root authorization method authorizes its transaction messages. If the account is rekeyed, the authorization method associated with its authorization address is used instead.

A relationship between a root key and voting keys is established when accounts register their participation in the agreement protocol.

For further details on the key registration (keyreg) process, refer to Ledger specification.