When inserting authority keys, should I choose the controller derivation, the stash derivation, or just the vanilla secret?

Question

Starting a PoS network, I realised that my local node requires keys to start producing blocks. Unlike in test networks where I could simply pass --alice and have the validator keys inserted into the keystore and start block production, how do I go about doing it for a different account? In PoS we have controller and stash accounts, so if I am going to insert my keys like this :

./target/release/node-template key insert --base-path /tmp/node01 \
--chain customSpecRaw.json \
--scheme Sr25519 \
--suri <your-secret-seed> \
--password-interactive \
--key-type babe

whose suri should this be? Stash? Controller? Or just my regular seed from which I have derived both stash and controller addresses?

Answer 1

The authority key is neither the controller nor the stash key.

What you call authority key, is actually called session key. Such a session key can be changed once per session. For the genesis you need to specify the keys of the genesis authorities. You only specify the public key in the chain spec. This public key should be unique and not belong to the stash or controller. How you generate the public key is up to you, as long as you use the correct crypto.

Answer 2

You should create a new identity/keys each node.

The actual "controller" or "Authority" are defined in the chains genesis block. You can see an example of this in the substrate node template:
https://github.com/substrate-developer-hub/substrate-node-template/blob/main/node/src/chain_spec.rs

For information on how to create keys for your nodes:
https://docs.substrate.io/tutorials/v3/private-network/#generate-your-own-keys