A question about the digital currency "money bag"

background

Since the birth of Bitcoin, the blockchain technology behind it has also become a new enthusiasm in recent years. Blockchain technology provides a new way of sharing data and value, which is exciting. More and more cryptocurrencies have emerged, trying to improve the traditional centralized currency system, thereby reducing transaction friction, improving liquidation efficiency, and realizing asset ownership in the hands of individuals.

The chart below shows the total value of the global cryptocurrency market from 2013 to 2018. As you can see from the chart below, in the beginning of 2018, the global cryptocurrency totaled 800 billion US dollars. Although the global cryptocurrency market continued to decline in the future, its volume is still quite large.

In cryptocurrency, there is no longer a centralized organization like a bank to encrypt and store sensitive data such as personal account passwords. Therefore, compared with the traditional payment industry, the security level of the private key management method in the blockchain system is far from the same level. Currently, there is no uniform standard for private key management in the blockchain system, and there is no authoritative testing organization, each cryptocurrency. The use of encryption algorithms and private key management schemes varies widely. This has also led to the loss of private keys and theft of private keys since the birth of cryptocurrency, causing serious asset losses to users, which is one of the key issues that hinder the large-scale application of blockchain systems.

• Popular Science | A Probe into the Trusted Identity Model
• "Pizza Festival" outside | Milk powder, watches and long hair iPhone 6
• Blockchain game: irrelevant technology, as long as fun

As far as Bitcoin is concerned, the damage caused by the private key management problem is already very huge. The following are the cases of the stolen private key of two Bitcoin exchanges:

In February 2014, 850,000 bitcoins on Mt.Gox, the world's largest bitcoin exchange operator, were stolen, causing losses of $500 million, which directly led to bankruptcy.

In August 2016, due to website security vulnerabilities, Bitcoin, a Bitcoin trading platform, was stolen and stolen Bitcoin was 119,756, which was a total value of about $65 million at the time.

According to the 2017 analysis of Chainalysis, as of 2017, approximately 4 million bitcoins have been considered permanently lost. Of these, 2.5 million were due to Bitcoin holders accidentally losing their private key data. Since there is no bank-centric organization in the blockchain system to back up sensitive information such as user accounts and passwords, the 2.5 million bits are no longer recoverable. Therefore, for cryptocurrencies, the management of private keys is crucial.

The difference between blockchain private key management and traditional payment industry

For the traditional payment industry, there is a centralized organization responsible for storing sensitive information about users. These centralized organizations are generally banks or Alipay. These third-party organizations have formed a complete standard system for the security protection of user-sensitive information, so it is very difficult to steal user-sensitive data from the outside. In the traditional payment industry, all aspects of the generation, storage, use, retrieval, destruction and updating of sensitive information of users have strict standards, and all related equipments need to be tested by relevant authoritative laboratories.

Of course, these are based on the endorsement of trust in centralized institutions. This is also a problem with its blockchain system. Once there is a problem within the centralization organization, there will be no security for all user sensitive data.

In the blockchain system, since there is no centralized organization responsible for managing sensitive data of backup users, the generation, storage, use, retrieval, destruction, and update of the user's private key require the user's own protection. This is for the private key in the blockchain system. The design of management is a big challenge. However, compared with the traditional centralized organization responsible for managing the storage of personal asset certificates, in the blockchain system, the personal assets are truly in their hands, and everyone is a bank.

However, there are still two problems here:

1. Are people ready to be their own bank?

2. Does the current blockchain system provide users with a safe and complete private key management method?

For question 1, the current people's security awareness is obviously not ready to complete their own bank. In the current centralized payment system, the user's security awareness is a weak link in the entire security system, even if the bank and payment devices in the entire payment link reach the corresponding security level. If the user does not have a certain security awareness, use a lower security PIN value, or multiple accounts with different security levels share the same password. In the case of conflicts between convenience and security, the user's security awareness becomes the weakest link in the entire payment process. For the blockchain system, since users are completely responsible for their own assets, they have higher requirements for user security awareness.

For question 2, compared with the traditional centralized payment system, it has a series of very mature security standards and specifications for private key management, and the relevant institutions and equipments in all aspects of the payment industry need to be strictly enforced by the authority. Detection. However, in the current cryptocurrency industry, there is no relevant standard, and the testing organization has no relevant plans for private key management design. This is also the main reason for the frequent security problems in the cryptocurrency industry.

Thoughts on private key management of blockchain system

For the current blockchain system, when designing private key management, it should learn from some standard mechanisms of the traditional payment system, and learn from the nutrition that can be applied to the current blockchain system. Because these algorithmic mechanisms are tested for a long time. Therefore, it is very useful to enhance the security and standardization of private key management in the blockchain system. It can also promote the standardization and standardization of private key management related solutions in the blockchain system. In addition, for the entire industry, the establishment of relevant authoritative assessment and testing institutions is also urgently needed by the current industry.

In addition, it is not enough to focus on the design of system private key management, and it is necessary to improve the user's security awareness through various methods. In the traditional payment industry, there are strict standards for user guidance and the like. In terms of the PCI standard, in its standard for payment devices, there are special standard items for user safety guidance, and developers need to provide detailed guidance documents, process control, and so on. Therefore, for the blockchain system, it is necessary to provide users with detailed guidance materials for easy reception, and enhance the user's own security awareness for private key management. It makes it possible to reasonably choose the private key management method according to the value of its own assets, and to avoid damage-related behaviors.

Private key life cycle

In the blockchain system, the private key is the unique credential of the user's assets, which has an account and password with the traditional payment institution user, and the account and password are not relevant. Since the public key can be calculated from the private key in the electronic money, all security protection will be carried out around the private key. Therefore, for the entire life cycle of the private key, it is necessary to have a strict way to manage it.

Private key generation

Whether in a traditional payment system or in a blockchain system, the secret key is generated by a random function. Therefore, the randomness of the key generation process is very important. If the key generation process is not random enough to make it predictable, then all subsequent security measures are futile. In the traditional payment industry, the random number generation of related equipment involving key generation must be strictly tested by relevant institutions. And it is generally performed using a random number generation module of a dedicated security chip. In the blockchain system, if the system uses pseudo-random functions, its security is not comparable to the traditional payment industry. Therefore, when designing the private key generation mechanism of the blockchain system, we need to pay special attention to the random number generation method to make it sufficiently random.

2. Private key storage

For the generated private key data, the local disk cannot be barely existed, and the secret key is used to encrypt the storage. If the private key needs to be encrypted, the encryption algorithm and the length of the encryption key used must be higher than the strength of the encrypted key. And if you use the verification key, the same key can not be used for a variety of purposes. The relevant standards of these traditional payment industries can be used for reference.

3. Private key use

When the private key is used, it is necessary to ensure the security of the environment. For the access, reading and writing of the private key file, it is necessary to have relevant authority control. After the use is completed, all sensitive data cached in memory needs to be cleared by a special function to prevent sensitive data from leaking.

4. Private key recovery

For the traditional centralized payment institution, when the user asset certificate is lost, the relevant data can be retrieved through the centralization institution through its own identity certificate. In the blockchain system, there is no centralized organization to help users back up sensitive data such as private keys. Therefore, when designing the system's private key management scheme, it is necessary to provide multiple backup and recovery methods, such as using mnemonics or recovering private key data by using a password plus a local ciphertext file.

5. Private key destruction

When the user needs to destroy the private key data, it is necessary to ensure that all private key data stored in the backup is completely deleted and destroyed.

6. Private key update

When the user needs to change the private key, it is necessary to ensure that the new private key is safely generated or imported, the asset is safely transferred, and the old private key is safely destroyed. In the traditional payment industry, the above-mentioned various aspects of the key life cycle have strict program standards, so it has certain reference significance for the design of the blockchain system private key management scheme.

Source: Dipperin

We will continue to update Blocking; if you have any questions or suggestions, please contact us!