What’s So Cool About Crypto Cold Storage? A Look at Blockchain Wallets

Even if you are not interested in cryptocurrencies or blockchain technology, the hardware and systems available to keep these things safe are still interesting and relevant for data security overall.

The year 2017 was certainly a notable one for cryptocurrencies—interest in investing in (and debate about) cryptocurrencies has never been higher as coins like Bitcoin reached all-time highs. Increasingly diverse blockchain projects also continue to materialize.

While it’s not possible to say for sure if cryptocurrency is a passing fad or the future of finances, it has proven to be an excellent driving force behind cold storage technology. For users and investors handling large amounts of cryptocurrency, keeping the private keys of their “wallets” is an increasingly important aspect.

Here is a crash course on the blockchain wallet, various versions that exist, and the technology behind them that is currently keeping investments safe outside of the bank. Even if you are not interested in cryptocurrencies or blockchain technology, the technology to keep these things safe is still interesting and relevant for data security overall.

What temperature do you like your wallet?

Just as the name suggests, a blockchain wallet is where cryptocurrencies belonging to a user are stored. Every wallet consists of a public key, which everyone can see, and a private key, which only the user should be able to access. Every time a transaction is made by a user, that transaction is signed and authorized by their private key. Then that transaction goes on to be recorded by the network and onto the blockchain.

Currently, there are a few ways a user can create and access their wallet:

• Online wallets, such as ones used on cryptocurrency exchanges
• Hot wallets, usually as an application on a personal computer or smartphone
• Paper wallets, which involves printing the key pairs onto a piece of paper
• Hardware wallets, a form of cold storage that keeps your private key offline when not in use

 

Exodus is an example of a hot wallet, which is used on personal computers. Image courtesy of Exodus.

 

Online wallets and hot wallets, while popular and regularly used, are generally considered quite insecure since they store the private keys of wallets on devices connected to the Internet. If you search online for “crypto exchange hack”, you’ll find many examples of exchanges being compromised and private keys being stolen from servers.

For personal devices, the security of the device is completely based on the user, which means they could be at the whimsy of keyloggers or ransomware attacks. The general idea, though, is that as long as your private key is stored on a device that is connected to the Internet, they are at risk of being stolen. And with so much value existing in cryptocurrencies, there are a lot of people who will intentionally target and try to access these private keys. 

Further, if someone does access your private key and drain your wallet by sending all of your money to another wallet, there is no way to recover those funds, even though you can see the transaction. 

That’s where hardware wallets come in, a form of cold storage. There are several varieties of hardware wallets available, with Trezor and the Nano Ledger S being some of the most popular. Both work in similar ways: they look like a USB device with a small screen, and allow you to set up and create a digital wallet that can be taken offline when not being used. Various levels of security are included so that, even when connected briefly to a computer to generate transactions, the chance of having private keys stolen are significantly minimized. They’ve become essential tools for people putting significant money into cryptocurrencies. 

U2F - Universal Second Factor

Some hardware wallets, such as the Trezor, uses U2F to authenticate access. U2F is sort of the next generation of Two-Factor Authentication (2FA), which works by requiring two factors to log into an account: the user’s password, and then a generated code accessible by email, SMS, an app, or a special device. This adds a layer of security so that even if someone can brute-force guess a password, getting the second factor will add enough complexity to prevent access. 

The problem with 2FA is that the master key is sent online during its initial setup. This creates a very serious weak spot in the whole process which a clever attacker could possibly exploit.

With U2F, the second factor is a physical security key that you plug into your computer’s USB port. When the U2F device is being used to register with a service, it uses a hardware random number generator to create a nonce, takes the AppID sent by the service, passes it through a hash-based message authentication code function, and is stored with the device’s private key. The output of the function then becomes the private key for the application and then creates the public key by hashing the application private key with the AppID, and the output is combined with the nonce to create a key handle. Then, whenever the second factor is required to log in, the device can be plugged in and will verify directly with the server. 

It’s also not possible to impose replay attacks on U2F devices, nor is it possible to clone them. So, for hardware wallets, this is a highly desirable second factor. 

 

Diagram of U2A. Image courtesy of Tripwire.

Mnemonic Recovery Seed

Seed words, or recovery phrases, is probably one aspect that confuses non-technical users of hardware wallets the most.

When first setting up a hardware wallet (or even with hot wallets), a mnemonic seed consisting of 12 to 24 words is given to the user. In the event that the hardware wallet is lost, it’s still possible to regain access by using the recovery phrases to regenerate access to the wallet. 

 

Image courtesy of xkcd.

 

However, this makes storing the recovery phrases exceptionally important. Some users go as far as engraving the phrases onto metal plates and storing them in safety deposit boxes (which is sort of ironic since the spirit of cryptocurrency is to remove dependence on banks). Being physical devices, hardware wallets are still subject to being lost or damaged. 

Mnemonic recovery words are used because they are friendlier to humans and are easier to remember and understand. And, they’re still random enough that brute-force guessing is near impossible. 

 

The Ledger Nano S prompting the user to get ready to write down their recovery phrases. Image courtesy of Ledger Wallet.

PIN and Password

One of the last lines of defense is the PIN and/or password. Hardware wallets can be set up with one or both to add even more security. Some devices also impose a time delay between wrong password guesses that increases exponentially so that, in the event that a hardware wallet is lost or stolen, it will still take the attacker too much time to brute-force guess the pin or password. This tactic gives the user time to recover and move their funds to another account before it’s too late.

Keep It All Offline

Ultimately, when all is said and done, the most critical aspect is that as much information as possible is kept offline and disconnected from the Internet when not in use. If your computer is attacked by a keylogger or ransomware or if an exchange server is compromised, your separate offline device will still be safe with your cryptocurrency.

There are many other layers that exist or can be added to increase security even more and, since people are willing to pay for well-engineering devices to keep their money safe, there is an incentive to keep developing hardware wallet security.

---

 

The motivation to keep digital currency safe is obvious, but the process can also be used to keep other highly critical information safe, as well. Such security measures could be useful for health data or general data that a user simply wants to be secured. 

So even if you disagree with the cryptocurrency concept, the interest has still managed to advance both blockchain technology and private key security. 

Feature image courtesy of Cryptomorrow.