05_Digital Asset Custody Flashcards
Reasons for Loss of Crypto Assets
- sent to invalid addresses
- stuck in wallets with lost keys
- loss of physical wallet
Evolution of Custody Technology
- safes
- commercialization of safe deposit boxes that could be billed (20th century)
- increasing security requirements due to growth of data volume (21st century)
- new era of digital storage with invention of blockchain (secure storage of keys)
Role of traditional banks
- saving & deposit
- lending & financial advice
- physical network & services
- traditional assets
- centralized structure
- insurance and coverage
Role of digital asset custodian
- cryptocurrencies and other digital assets
- decentralized structure
- mostly only
- blockchain settlements
- technical knowledge & maintenance
- insurance but no coverage
What is wallet
- wallets are digital, limited physical existence
- technically do not store crypto
- holdings live on blockchain, accessed using your **private key **
- crypto wallets store your private keys safe and accessible
Digital Asset Wallet
aka Crypto Wallets / Hot Wallet
- secure digital vault
- storage & transaction tool
- multi-currency support
- interact with blockchain
- public &** private keys**
- access & control over assets
- security and privacy
- backup and recover
- easy to trade assets
e.g. Metamask, Phantom, Trust Wallet
when connected to internet subject to hacking, cyberattacks etc.
Types of Wallets
- Digital Asset Wallet
- Cold Wallet
- Hardware Security Module (HSM)
- Warm Wallet
Cold Wallet
2 overarching
Hardware Wallet
- offline air gapped -> no direct vulnerability to hacks
- Risk of losing your holdings (loss of wallet)
- can be costly
- no instant access to holdings -> transfer of assets is time intensive & requires connection to network
Paper Wallet
- key is written on piece of paper
- store at secure location
- use of funds difficult -> digital mone can only be used on internet
Hardware Security module (HSM)
- physical device designed to be tamper-resistant and tamper-evident
- multiple physical measures that safeguard and manage digital keys
- facilitates encryption, decryption, signing and verification
- private key is generated within HSM
- private key is never exposed -> cannot be copied or hacked
Warm Wallet
- software / mobile wallet
- form of digital storage that can be accessed through a computer or phone
- often used to interact with DeFi applications, NFTs or exchanges
- always connected to internet -> vulnerable to hacking or phishing attacks
- allows for instanteous transfer of funds
- vulnerable to government regulations -> if governments bans crypto, your warm wallet funds can be seized
- often available for free
Private Key
vs
Public Key
Cryptographic Key Pair is the hear of this technology
Private key
- very large random number
Public key
- can be derived from the private key, but not vice versa
Wallet address
- public key is hashed to create a wallet address -> more convenient
Key Generation of Private & Public Key
- Random Number Selection
- Elliptic Curve Cryptography (ECC): private key is inputted into an elliptic curve multiplicaiton formula
- Public key generation: coordinates of second point on curve represent public key
- Hashing: public key is hashed using SHA256 algorithm, producing shorter, 160-bit hash
- Wallet Import Format: the private key can be converted into a wallet import format for importing & exporting ease of use
Bitcoin Transaction process
- Formulate Transaction
- Build Transaction message
- Sign Transaction
- Broadcast Transaction
- Transaction into Memory Pool
- Nodes Validate & receive rewards
- Block added to Blockchain
- Confirmation and validation
Wallet recover - seed phrase
- series of words (12-24)
- seed phrase like master password
- access to seed phrase = access to wallet
- seed phrase unlike private key
- private key allows to sign transaction
- seed phrase = access to wallet and all private keys in wallet
Attack Vectors
on private key
- brute force attacks: guessing private key with excessive testing
- implementation flaws: errors in programming exploited by hackers
- backdors: secretly embedded master-keys that defy algorithm known by only few
- quantum computing: brute forcing on steroids
- human errors: loss or theft of private keys