Pragmatic Analysis of Key Management for Cryptocurrency Custodians

Abstract

We discuss key management for cryptocurrencies from the perspective of security and risk management. While we found many earlier research studies about the implementation and security of wallets, few of them provide a comprehensive analysis of real-world integration as a complex system. We particularly focus on cryptocurrency custodians, who have to tightly control the risk to meet business needs as well as regulatory requirements. Unlike individual use cases, to manage substantial amounts of various assets, they typically need more complex wallet configurations and operations, such as multiple layers of hot and cold wallets in combination with different types of implementations. Therefore, we discuss the suitability of various wallet techniques, including software, hardware, HSMs, smart contracts, or cryptographic methods. We also address several open challenges for custodians mentioned in earlier work. Furthermore, as the ultimate example, we propose Extreme-Cold, a reference cold wallet in an air-gapped environment. It is resistant to side-channel attacks studied in earlier research. The risk assessment we conduct on Extreme-Cold demonstrates the effectiveness of our systematized knowledge.