Namaste Yogis. Welcome to the Blockchain & AI Forum, where your blockchain technology questions are answered! As a bonus, a proverb is also included. Today’s question comes from Wolfgang in Stuttgart and he wants to know what is the latest in crypto currency key management from Germany?
Wolfgang, you came to the right place. I understand why you would ask this question and its importance. After all, as often said in the crypto world, “not your keys, not your crypto!”. With that in mind I drove deep into academic research for the latest findings. I discovered an article titled, “Perceptions of Distributed Ledger Technology Key Management – An Interview Study with Finance Professionals”, Guthoff, et al, 2023, Helmhotz Center for Information Security, Germany. Their paper is focused on key management for financial institutions not individuals, nevertheless it is fascinating to learn what the BIG BOYS & GIRLS are thinking. .https://publications.cispa.saarland/3948/1/guthoff2023keymanagement.pdf
RESEARCH BACKGROUND AND METHODOLOGY: The researchers focused their attention on private key management within the traditional financial sector (trad-fi) and the cryptocurrency space (de-fi). By incorporating the views and perspectives of employees working in trad-fi and de-fi, the unique perspectives of the established and newer financial institutions were both included. Nice! In section two, the authors define a number of essential terms readers must understand to completely comprehend the findings. Below are two examples of terms that were defined:
Key Management: the activities involving the handling of cryptographic keys and other related key information during the entire life cycle of the keys, including their generation, storage, establishment, entry and output, use, and destruction. According Guthoff, key management is a combination of different key-related aspects, including key usage and storage. Guthoff explains further that the goal of key management is to generate, store, distribute, use, and revoke cryptographic keys (integrated into enterprise processes) while keeping the private key secret. Key Management is not necessarily equal to a (cryptocurrency) wallet, but a wallet may be used as a simple tool for key management.
Custodial Key Storage: is the storage of keys by a separate party, which can be either in-house or a third entity that does not use the key. This party can, but does not have to, take care of all other aspects of KM. For self-managed assets, this could be a cryptocurrency exchange. For financial institutions, custodial key storage can be implemented in-house or externally by an intermediary.
Research Findings: Essentially, the threats to key management fall into four different categories: internal, external, systems and infrastructure, and force majeure. Force majeure means unforeseeable circumstances. Unfortunately, the research paper covers too many findings for me to discuss them all; hence, instead I’ll give you just a few highlights.
Multi-signature keys: Multi-signature keys were a hot topic among respondent and participants were enthusiastic about the concept. According to the survey participants the two main benefits of this technique were resilience against key loss or compromise and added protection against malicious employees. Some participants also proposed storage of keys at a bank or a notary as a backup option.
Invisible Key Usage. The invisible key usage pertains to trad-fi but has implications for de-because management of private keys definitely holds back mass adoption. In the view of the survey participants, they preferred a solution where key usage is mostly encapsulated within an application and hidden away from the user. Although participants were referring to enterprise systems, the principle applies–the risk of losing a key through an attack or intended malicious actions by an employee. Participants thought usage of the key is best through access via personal credentials like username and password or multifactor authentication, using a phone or biometric features.
CONCLUSION: Bad news–researchers are skeptical whether existing key management systems can function effectively at the enterprise scale. They say efforts to maintain on-chain authentication and audit functionality covering day-to-day operations, e.g. employee absence or shifting responsibilities within the organization – as well as – contingencies such as key compromise or force majeure events – is unmanageable, except for the smallest institutions.
Time to say goodbye with a proverb from Germany: “one becomes wise through damage”.
Until next time,
Yogi Nelson
Blockchain & AI Forum 