Create accounts on an EOSIO private blockchain

Question

We are developing a private blockchain based on EOSIO. The account creation part puzzles me. AFAIU, cleos can be used to create accounts using pre-generated keys. I have a few questions:

1. What is the key generation process? Can the same keypairs generated for the mainnet be used on any private network?
2. What is the actual process of creating an account? I mean who runs the cleos command? Obviously, we would like the signup process to be similar to account creation on a normal website, but we also need to put some restrictions (permission levels) on users. I guess the restriction part can be done using a smart contract after accounts are created, but for the actual signup process, can we provide a web form for example? how to connect it to cleos?
3. What are the overhead considerations of account creation? I guess on the mainnet the user pays for the resources, but how do we go about it on a private net? I mean what stops people from flooding the RAM with multiple accounts?

Answer 1

1. Key generation is generating an R1 or K1 curve key, can be done with cleos

cleos create key --to-console                                                                                                                                                                                                                                                        
Private key: 5JAUG3p2STqB4116hfYFUMM5txWZHQFgQKe1PjJk6DnZbGaw7gg
Public key: EOS8ES35yBiPM3SExyfuTH2MChpALfPcJf8mSNMDpq5VQLbwcudFV

Yes same keypair can be generally used on any EOSIO chain that supports the curve you generated with.

2. above, if you want a simple signup process, I would talk to Raman and see https://dappaccount.com/ This allows you to easily add blockchain in, allow users to reset their keys with 2FA without having to touch any kind of wallet.

Otherwise you can use eosjs to generate keys in the browser. There may also be APIs with some of the wallets to handle this.

3. biggest overhead is all accounts must be stored in RAM, RAM on mainnet is around 140GB and grows slowly, so it can be costly to create accounts. If you use the dappaccount solution above, they handle this for you.

On a private network, you would still store accounts in RAM and it would be cheaper since your cost is the hardware cost, without the additional cost from competing in an open market for RAM.

Answer 2

What is the key generation process?

As Nat says in his answer, the keys are secp256k1 or secp256r1 curve keys. You can read more about that here: http://www.secg.org/sec2-v2.pdf

Can the same keypairs generated for the mainnet be used on any private network?

Yes. A private/public keypair created for one EOSIO chain is usable on another chain.

What is the actual process of creating an account?

Accounts are created by calling the newaccount action on the eosio system contract. You can do this via eosjs, cleos, or direct RPC calls. So you can use a webform in order to create an account, and send off the request using eosjs.

The arguments to the transaction are:

1. Account that will do the creation
2. New account name
3. Owner public key
4. Active public key

On a public network, you have to also provide enough RAM to create the account. This is approximately 1.6 KB. On a private network, I believe you do not have to provide RAM if you set up the account appropriately (accounts can simply not have RAM at all). I am not sure how to do this yet so will update this answer when I do.

What are the overhead considerations of account creation?

You are right that unrestricted access would allow a bad actor to consume the entire blockchain RAM by creating multiple accounts. Therefore I would recommend adding an element of cost to the creation of the accounts to put off spammers. This can either be a signup fee for account creation or a time-related cost. For example require them to prove that they are not a bot using Captcha technology. Require a valid email address and that the user confirms that they have access to the address, etc.