Distributed Secret Storage with Threshold Key Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing crypto wallet systems are vulnerable to single points of failure (SPOF) due to structural weaknesses, exposing private keys to untargeted and targeted attacks, and lack sufficient entropy strength, leading to potential theft of cryptocurrencies.
Innovation Solution
Implement a method that distributes secret storage and operations across multiple components using Personal Entropy eXtending (PEX) tokens, integrating redundancy and threshold signature schemes, eliminating SPOF by requiring multiple components to authenticate and ensuring entropy strength through passphrase and biometric inputs, with no separate recovery seeds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If private keys are stored in a single location for easy access, then ease of operation is improved, but reliability deteriorates due to single point of failure
Solution Approach 1:
The private key is divided into multiple shares distributed across different hardware security modules (HSMs) and cloud services. Each component stores only a portion of the key material, requiring coordinated access from multiple independent sources to reconstruct the full private key, thereby eliminating single points of failure while maintaining operational capability through distributed access mechanisms
2Ease of operation
If minimal entropy strength is used for user inputs, then ease of operation is improved, but reliability deteriorates due to insufficient security
Solution Approach 1:
A cryptographic key derivation function acts as an intermediary that transforms weak user inputs (passphrases) into strong cryptographic keys with sufficient entropy. The KDF incorporates salting, stretching, and hashing operations that amplify the entropy of the input material, ensuring that even simple user inputs result in keys with adequate security strength for protecting cryptocurrency assets
3Reliability
If separate recovery seeds are used for backup, then reliability is improved, but device complexity increases
Solution Approach 1:
The recovery mechanism is merged into the existing distributed key share system. Recovery seeds are integrated with the share recovery functionality, allowing users to reconstruct lost key shares through the same interface and process used for normal operation. This eliminates the need for separate recovery mechanisms while maintaining robust backup capability through unified access control and reconstruction protocols
4Ease of operation
If third-party services are used for key management, then ease of operation is improved, but reliability deteriorates due to trust requirements
Solution Approach 1:
The system implements self-service key management where users retain control of their private key material through distributed storage and access. Users can independently manage their keys across multiple HSMs and cloud services without relying on third-party custodians. The system provides automated key rotation, backup, and recovery functions while maintaining user sovereignty over the cryptographic material, eliminating trust requirements in service providers
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for providing secure protection of secrets. In some implementations, a passphrase and data corresponding to an authenticatable entity are received. An entropy extender is generated based at least on the data associated with the authenticatable entity. A key pair is generated using the passphrase and the entropy extender, the key pair comprising a public key and a private key. An identifier is generated using data from the public key, wherein the identifier maps to a file for storing content related to the authenticatable entity.