Cryptocurrencies such as Bitcoin or Ethereum are fast emerging as an alternative asset class where Investors can park part of their funds. Despite the bad press it received due to a series of failures, frauds and hacks of crypto exchanges , the interest in crypto assets have grown with significant increase in both the number of crypto currencies and the overall market capitalization of crypto assets. At the same time, the crypto derivatives markets have also seen a marked upturn amidst volatile prices. The crypto ecosystem is fast evolving and the regulators have started framing regulations surrounding the provision of crypto services ( exchanges as well as broker platforms) across the globe. There are well known crypto exchanges such as Binance, Kracken, Gemini, Coinbase , crypto.com to name a few. At the same time, the list of failed crypto exchanges are equally eye-catching- MtGox, FTX, Blockfi, Celsius and WazirX comes to mind.
Since cryptos reside in the cyber world, strengthening the information and cyber security arrangements are key to ensure protection against hacks and frauds. The basic understanding of crypto risks and look around from public disclosures of exchanges can provide a broad idea of the robustness of your crypto investments.
A good idea of the security framework can be gauged from the following arrangements .
The regulatory framework : I would recommend any investment in crypto assets through exchanges and brokers that are regulated. This is because regulation ensures that the basic building blocks are in place – robust systems and applications, approved crypto currencies, regulated fee structure, controls over wallet flows, periodic proofs of reserves among other requirements. The regulatory framework also ensures the availability of human resources to monitor potential crypto frauds and keeping a close eye on fund movements in blockchain including movements to compromised wallets or bad actors.
Cryptographic Asset Management Practices: Any beginner in the world of cryptocurrencies will know the importance of preserving/ protecting the private key. The private key is the password that holds the secret of your wallet. Once the private key is compromised, the wallet is under serious hacking threat. In an anonymous world, the key is your identity. Therefore, Key and related seed phrases hold the wallet together to keep your assets safe. The generation of cryptographic keys and seeds therefore has a paramount importance in a cryptocurrency system. The secure creation of cryptographic keys rests on ensuring confidentiality and generation of un-guessable numbers.
In an attempt to protect confidentiality , service providers ( read Crypto exchanges) ensure that cryptographic keys and seeds are securely created by the actor who will be using it. This is an attempt to protect the confidentiality of the key. To put this simply, any system that requires one actor to transfer a key or seed to another actor after generating it is suspect ( although automated agents are allowed in permitted in certain controlled environment).
The key or seed generation methodology ensures the generation of un-guessable numbers ( like difficult passwords) is validated prior to use. Software controls and generation of key protocols are important here. Typically, the key or seed is generated using a Deterministic Random Bit Generator (DRBG) that conforms to NIST SP 800-90A standard , and has been seeded with at least two separate cryptographically secure sources of entropy that have been combined in a cryptographically secure manner( NIST SP 800-90A is a standard that ensures that deterministically-generated numbers follow a random distribution with respect to a deterministic seed) . Alternatively, key or seed may also be generated by a Non-deterministic Random Bit Generator (NRBG), or a “True Random Number Generator” (TRNG) that passes industry-standard statistical tests for randomness such as DIEHARD, Crypt-X, or NIST STS. Simplespeak- key generation best practices should be followed by the exchange, which should be mentioned as part of FAQs for investor confidence.
Wallet Management 101 : Wallet Creation is the next critical security control. Simply put, there are wallets under the custody of exchanges for which exchanges provide security shield or wallets not under the control of service providers ( managed by the user alone). Here, we are focusing on the first type. While regulators expect key or seed strength by default, the regulated exchanges are closely monitored for their wallet management practices. The creation of wallets (or internet addresses that can receive cryptocurrencies) is critical. Wallets are created using key signing methodologies that can require a single key’s signature, multiple keys’ signatures, or a minimum number of signatures from many keys. An important control used by exchanges when protecting your wallets is Multi Sig Wallet Arrangement where any address generated by a wallet must require a minimum of 2 signatures or more ( 2 of 3 or 3 of 4) in order to spend funds, where a separate actor holds each signing key. Requiring 2 or more signatures on a wallet increases the integrity of funds by reducing the risk of theft associated with a compromised key or key holder. In a world with AI and humans, The actors can either be human or system. The multi-sig wallet is evolving into a multi party computational ( MPC) technology . Therefore, presence of a MPC to grant collaborative access to wallet is considered the best practice now as no actor has access to the full private key, but only part of it elimitaing single point of failure risk.
Other Controls :
Geographic distribution of keys is another robust and secure way of wallet protection. Any keys that have signing authority on a single wallet must be stored in different locations. By separating the wallet’s keys across multiple locations, the risks associated with localized disruptions to business (i.e. fire, flood, earthquake, break-ins) do not affect the organization’s ability to spend funds. Moreover, by giving keys to separate legal entities, such as lawyers, accountants, or other businesses, legal risks that can disrupt your business will not necessarily disrupt your funds.
Storage Arrangements : Beyond the key creation and wallet management, key storage practice is part of crypto asset’s security at rest. To maximize the confidentiality, keys are stored with encryption and air-gapped ( physically outside internet connected zones) . That’s why crypto exchanges ask you to take a printout of your key and store it physically. Moreover, exchanges ensure that a backup of the cryptographic key/seed must exist. The backup can take any form (paper, digital, etc.) which are protected against environmental risks such as fire, flood, and other acts of God ( Example- water-tight bag for flood protection and a safe or firebox for fire protection). A backup must exist for at least as many keys as is required to spend funds. For example, in a 2-of-3 signing setup where any two of three keys are required to spend funds, backups must exist for at least 2 of these keys. In a 5-of-9 setup, backups must exist for at least 5 keys.The backup key/seed must be stored in a location that is geographically separate from the usage location of the primary key/seed in escrow with a trusted third party).
Secure User Access: Moreover, crypto asset service providers ensure that they are used in a secure manner that minimizes the risks to the confidentiality of private keys and integrity of funds. In this context, access to the primary key/seed requires an identifier (e.g. username, email, GUID, etc.) and at least 2 (two) other factors of authentication, which restricts access to the authorized operator. All keys/seeds are only used in trusted environments. This reduces the risk of unauthorized copies being made by malware, as well as mitigating the risk of storing (even inadvertently) a key on a machine, allowing it to be recovered by another user or intruder. An effective trusted environment guards against unauthorized persons learning private keys, passwords, or other sensitive information.
- All these may seem excessive, but in a digital world, bad actors are always in the hunt for weak cryptography and wallets and it is these controls that protect your funds ( which are nothing more than alphanumeric strings in an anonymous world).
Robust Internal Control Measures : Crypto asset service providers therefore take internal control measures after setting up the key/ wallet protection arrangements. These controls include:
A proper Key Compromise Protocol outlines each specific class of key used throughout the system wherein a thorough plan is available to deal with compromise. Moreover, policies and procedures surrounding granting and revoking access to cryptographic keys or seeds that store organizational or end-user funds. All keyholder grant/revoke requests are conducted over Authenticated Communication Channels. Each entry within the audit trail is attested to by the staff member who performed that task.
Trust being essential to crypto business, exchanges periodically carry out third-party reviews of the security systems, technical controls, and policies that protect the information system from all forms of risk as well as penetration and vulnerability tests designed to identify paths around existing controls. Third parties independent assessments provide a different viewpoint and can be objective and critical of the service provider arrangements..
Security audits and/or penetration/vulnerability tests are performed on a defined schedule of at least once per calendar year. The audit covered both static and dynamic analysis of source code to ensure secure programming patterns were used wherever applicable, and cryptographic libraries were used properly wherever they have been employed.
Moreover, timely and proper sanitization of digital media ensures the proper removal of all keys, eliminating the risk of information leakage from decommissioned devices like servers, hard disk drives, and removable storage.
Finally, Proof of Reserve (PoR) of exchanges where you entrust your crypto assets in wallets they manage are of paramount importance, as was seen in recent crypto exchange frauds. This aspect covers the proof of control of all funds that should be held by the information system. There have been known cases where information systems that should be operating with a full reserve of user funds have been operating with a fraction of that reserve instead leading to an inability of the system to cover simultaneous withdrawals by all users. These proofs of reserve provide assurance to the public that all funds are available to the system which eliminates the risks of fund loss. To gain public confidence in PoR, crypto exchanges must publicly disclose that an audit has been completed and published online that proves full control of all funds held by the information system. The audit has been signed by an independent party that attests to the accuracy of the audit at the time it was performed which reduces the risks associated with inaccurate or misleading reports. Good organizations conduct regularly scheduled proof of reserve audits that provide proof that the organization continues to operate on a full reserve and that all user funds are accessible at the time each audit is completed. In some exchanges, information system is designed in such a way that it uses public ledgers to make this information available to the public allowing anyone to conduct an audit independently.
While deciding using a crypto asset service provider for the first time, it will be useful to do a bit of research yourself to look at the availability of above controls. Usually, exchanges disclose this information on their website in FAQs or security related disclosures. Trust is a key to crypto business, and in case you do not find the above crypto currency related security controls in exchange disclosures, there’s a reason to think twice before investing through such service providers. After all, its your hard earned money!
Leave a Reply