Set up Shield6

This guide targets the v1.21.83 Shield6 mainnet configuration and chain ID 8979. Keep your node, interactive wallet and public parameters on a matching release. Use the web guide if you prefer browser registration and the hosted wallet interface.

Install · Parameters · Open the console · Local web service · Troubleshooting

1. Install a matching release

Download a package for your operating system from the v1.21.83 release. Verify the selected package against that release's SHA256SUMS before extracting or installing it. The download page lists the available platforms.

On Linux, the checks below illustrate verification of an already downloaded package:

sha256sum --ignore-missing --check SHA256SUMS
./gtkm version
./gtkm wallet interactive --help

Run those commands inside the extracted release directory. Use gtkm instead of ./gtkm if the package installed it on your PATH. The wallet help should list the interactive command, data-directory option and keystore option.

2. Start and sync your local node

Follow the Tor-only node guide and download/startup instructions. Use your own configured onion identity and a known onion bootnode. Keep RPC and IPC private. A Tor SOCKS listener is a proxy, not a blockchain peer.

Keep the node running in its own terminal or service. Wait for a current head and connected peers. The interactive wallet connects to the local IPC socket associated with its data directory; it does not use https://wallet.tkmchain.site/rpc as its wallet command endpoint.

For a node with local HTTP RPC enabled, inspect its status:

curl --fail --silent --show-error http://localhost:8545 \
  -H 'Content-Type: application/json' \
  --data '[{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]},{"jsonrpc":"2.0","id":2,"method":"eth_syncing","params":[]},{"jsonrpc":"2.0","id":3,"method":"net_peerCount","params":[]},{"jsonrpc":"2.0","id":4,"method":"tkmprivacy_shieldedV6Status","params":[]}]'

Expect chain ID 0x2313, an active Shield6 status, recipientProofsRequired: true, and the release's four production key hashes. eth_syncing: false alone does not prove a current node: also compare the head and peer count with the explorer. A node with zero peers cannot receive new blocks until connectivity returns.

3. Install authenticated public parameters

The native wallet needs both the recipient and registration parameter sets. These are public proving artifacts, not account seeds. The complete uncompressed set is about 648 MB; proof construction needs additional RAM. First loading and proof construction can take minutes, especially on memory-constrained hosts.

The release parameter archive is Shield6-parameters-v2-v1.21.83.tar.gz. Verify it against the release's SHA256SUMS, then extract it:

sha256sum --ignore-missing --check SHA256SUMS
mkdir -p "$HOME/.tkmchain/shield6-parameters"
tar -xzf Shield6-parameters-v2-v1.21.83.tar.gz \
  -C "$HOME/.tkmchain/shield6-parameters" --strip-components=1
export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"

The archive contains one shield6-parameters/ directory. Set the environment variable to the directory containing the files themselves, not its parent. Confirm the expected files exist:

for name in recipient.r1cs recipient.pk recipient.vk manifest.json \
  registration.r1cs registration.pk registration.vk registration-manifest.json; do
  test -s "$TKM_SHIELD6_RECIPIENT_PARAMETERS/$name" || exit 1
done

Alternatively, from a source checkout of the matching release, use the authenticated downloader. It checks file sizes and SHA-256 hashes from the checked-out release metadata before publishing each file:

git clone --branch v1.21.83 --depth 1 https://github.com/tkmchain/go-tkmchain.git
authenticated_source_dir="$PWD/go-tkmchain"
cd "$authenticated_source_dir"
python3 scripts/shield6-release-parameters.py \
  --output "$HOME/.tkmchain/shield6-parameters"
export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"

Set the variable in the shell that launches the wallet, including on later sessions. Setting it only in the node service does not set it in a separately launched terminal wallet. The wallet compares manifests and parameter bytes with the node's consensus pins when opening the prover. Do not generate new ceremony parameters to replace the mainnet files.

4. Open the correct local account

Keep a backup of the original encrypted ML-DSA-87 keyfile and its saved stamp data. To create a new local PQ account, use the account command and enter its password interactively:

gtkm --datadir "$HOME/.tkmchain" account new

Account creation does not fund it or confirm its stamp on-chain. Arrange public registration gas and follow the stamping steps below. If you already have an account, restore its original encrypted keyfile instead of making a replacement for an immutable registration.

Use the same data directory as the running node. If the account is in a separate keystore, specify that directory explicitly:

export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"
gtkm wallet interactive --datadir "$HOME/.tkmchain" --language en

For a separate keystore directory:

gtkm wallet interactive --datadir "$HOME/.tkmchain" \
  --keystore "/path/to/your/keystore" --language en

The second command uses a placeholder path; replace it with the actual local keystore directory. Passwords are entered at the wallet's prompt. Do not paste a password or seed into a receiving-code field or into a shell command.

5. Prepare to receive and send

Use 7 — Stamp address if the account has not already been stamped. Then use 19 — Register Shield6 recipient keys and 15 — Show Shield6 payment code. Registration costs public gas and permanently binds the recipient-key commitment.

To fund private notes from public TKM, use 17 — Deposit TKM to Shield6. To pay another Shield6 recipient, use 2 — Send with their complete tkmshield6r. code. Read the full interactive console walkthrough before submitting a payment.

Optional local service for the web wallet

The console wallet already proves locally and does not need a separate payment-prover service. The native node also has an authenticated embedded wallet service. Its flag names still start with shield3, but a Shield6-capable release uses it for Shield6 operations too.

Start one node with the parameter variable in that node process's environment. The example below requires your own configured onion identity and a valid known onion peer. Replace both placeholders before running it:

export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"
gtkm --datadir "$HOME/.tkmchain" --port 3000 \
  --privacy.onion-only \
  --p2p.tor-socks5=socks5://127.0.0.1:9050 \
  --p2p.onion-hostname='<your-node>.onion' \
  --bootnodes='enode://<peer-key>@<peer>.onion:3000?discport=0' \
  --http --http.addr=127.0.0.1 --http.port=8545 \
  --shield3.host 127.0.0.1 --shield3.port 8788 \
  --shield3.allowed-origin https://wallet.tkmchain.site \
  --shield3.token-file "$HOME/.tkmchain/shield3-wallet.token"

If your node already runs as a service, update its existing launch configuration and restart that one node instead of opening a second process on the same data directory. Do not launch the obsolete standalone gtkm shield3-wallet command alongside it.

In the web wallet, leave wallet-server proving unselected, expand Use my local wallet service for scans and payments, and set the URL to http://127.0.0.1:8788/shield3. Open the protected token file locally and enter its token in the local-wallet token field. Keep that file and token private; the browser keeps the entered token only in the page. Allow local-network access if your browser asks. Registration still uses the network RPC and does not need this token.

If you instead choose the hosted payment prover, review the explicit seed-sharing dialog for each operation. The web wallet guide explains that trust boundary. Browser recipient registration needs neither a local wallet token nor an upload of your seed.

Troubleshooting setup

• Install authenticated Shield6 registration parameters first: set TKM_SHIELD6_RECIPIENT_PARAMETERS in this wallet's shell and check registration-manifest.json and all three registration artifacts.
• Recipient parameter directory or manifest missing: check the four recipient files in the same directory. Both parameter families are required for the complete wallet flow.
• Parameters do not match chain configuration: check the chain ID, release and authentic file hashes. Replace damaged downloads with the matching release artifacts; do not bypass the check.
• Connect to gtkm IPC failed: start the node and use the same data directory and operating-system account. Keep the IPC socket private.
• No local accounts: point --keystore at the intended directory or restore the encrypted account backup using the supported wallet account workflow.
• Registration already exists or stamp differs: restore the original stamped keyfile. The original immutable registration cannot be repaired by inventing new stamp or recipient keys.

Continue to console sending · Use the web wallet

Build from source

Use the Shield6 source-build guide to compile the node, payout prover and provider CLI, then install the matching production parameters.

For a fresh host, continue with new-server and username setup. The public bootstrap kit configures the existing directory authorities with the new server's own identity.