The Weakest Link

11/12/22

With the recent implosion of FTX the topic of self-custody has become suddenly popular again. So, let’s review some strategies for how to self-custody your assets safely. I know some of this is intimidating. If this is your first time doing it, you have never been exposed to cryptography primitives before. It can all be very confusing and seem too tech heavy. The good news is this is just about the only time you’ll touch cryptography in cryptocurrency and you can do this simply without the more convoluted strategies I’m about to cover. Everything more complicated than the first steps below are optional. More complicated schemes address increasingly unlikely problems and only become really necessary as you start to have more at stake.

There isn’t a single right approach to private key security. There’s a spectrum of complexity vs security in the options I’ll talk about here. I hope by describing the layers, the risks they mitigate, and the complications they create that everyone can find their own optimal point in this spectrum. There are plenty of good guides on: what a private key is, how it relates to a mnemonic phrase, various hardware wallets, etc. That isn’t the focus of this post. This post is focused on private key security approaches.

Back in 2017, the first guides I read on wallet security outlined a basic plan to store your private key.

Store your private key whole.
Engrave it in steel so it can’t be lost in a fire.
Store that in a vault.
Always use a hardware wallet. Optionally initialize multiple hardware wallets as backups.

This problem with storing the whole key in one place is things can go wrong. A location can become compromised, destroyed, or inaccessible. If you copy the whole private key to multiple locations then you multiply the risk of your assets being compromised as well. The minimal viable security I’d suggest you have if you have more than a few thousand in self-custody is to use key fragments.

Key Fragments

To the uninitialized a key fragment approach is like a treasure map. You make two copies of the map, split each copy into thirds, and store two unique unique parts in three different locations. Obviously, rather than being a map though this applies to your 24 word mnemonic phrase. The result looks as follows:

Location 1	Location 2	Location 3
1-8		1-8
9-16	9-16
	17-24	17-24

The advantage here is that more than one location has to be compromised for your private key to be compromised. Counter to that approach, I saw people such as Andreas Antonopoulos argue that this was a catastrophic reduction in security. Despite his warning, when I first setup a hardware wallet, I felt the risk/reward tradeoff was worth it compared to storing the whole key so I went for it. In hindsight, and after some solid discussion on /r/ethfinance, I believe the concern of someone compromising a single fragment and then being able to brute force the remaining 8 words is overblown. That said, absolutely never do this with a 12 word mnemonic. If you feel like being even more careful the next option is for you.

Shamir’s Secret Sharing Scheme is an approach that accomplishes everything the key fragment scheme above does with the added advantage that each key fragment offers no information about the whole key. This is inarguably more secure than the key fragment approach but comes with a tradeoff of complexity and risk of recoverability. In the simplest case, if you’re using a Trezor, they have built in support for Shamir’s mnemonic phrases using something called SLIP-39. For everyone else, there are a few challenges that come with Shamir’s over mnemonic key fragments.

There is no standard implementation of Shamir’s. Therefore you should store whatever code is required to decode the Shamir fragments alongside them.
Shamir’s by default doesn’t use mnemonic phrases. Your key fragments look like 1-SomeShortHashyThing instead of words. This increases the risk of physical damage to the storage of the keys if you are writing them down or engraving them as well as being a miserable experience to transcribe.

Storage

The above discussion of course begs the question of how to store and secure key fragments, Shamir or otherwise. Basically, I follow all the original advice for storing mnemonics with a little extra leg work.

Store them on a fire resistant medium like steel.
Store them in a tamper evident way. The less visible this mechanism is the better. Even if a fragment in isolation were absolutely harmless you’re better off knowing a location is compromised so you can initialize a new wallet and stop using that location.
Store them in a secure place. While this may sound obvious, there is some contention over what places are considered secure. Some people consider safety deposit boxes insecure. There’s an element of truth to that but I still use them. Just as anonymity is a form of security, so is obscurity. Obscurity is the enemy of recoverability though.
Store them in geographically remote locations. This isn’t just meteor-proofing; in some ways slowness adds security. If your instructions for recovery by your kin are compromised you want more than a few hours drive for that to be reported to you before your assets are gone.

On the former point, let’s discuss the various crypto steel solutions. They are quite annoying to work with and quite expensive for what they actually are. That said, they are a trust-minimized solution. If you are comfortable significantly overpaying for some steel, fiddling with tiny metal plates, engraving letters by hand, or literally hammering letters onto steel with punches, you have that option. What I did the second time around was visit a few local metal engraving stores. These are the same stores that engrave plaques for sports but all they need from you is a greyscale image. If you only go to one store with your entire key then you trust that store not to rug you. If you go to 5 stores then you trust that there isn’t a tinfoil hat consortium of metal engravers sharing images with one another hoping to snag a private key. You can purchase these anonymously with cash and leave basically no electronic trail other than if the store retains the image printed for some reason. Personally this worked for me, just understand the risks.

What is actually on my greyscale image are the Shamir’s fragment in quadruple duplicate surrounding a qr code of the same string. It looks something like this:

The resulting plate fits in the palm of my hand and is easily scanned by a qr reader. Damage to the plate would have to be extensive for the key fragment to be irrecoverable. Each engraved plate cost $5 to $10 from different stores. The result is cheaper, provides a better UX, and is quite resilient to damage but it does take some time to make the greyscale images, drive to different stores for pickup, and comes with an element of trust that the store owners don’t all talk to one another and reconstruct my key. You can also store the Shamir fragment on a digital drive for convenience but that isn’t resilient to drive decay or fire.

If you follow all of the above, you’re resistant to a meteor strike big enough that your crypto holdings aren’t your biggest concern. Even in that case, if you can access your hardware wallet you can move the assets to a new account and start this whole process over.

When you generate the fragment images I suggest air gapping your machine first, creating the fragment images and loading them onto a thumb drive, and only reconnecting that machine to a network once the fragment images have been thoroughly deleted (you want to zero out the space on the hard drive with a data erasure tool).

Absolutely never:

Upload the fragment to a cloud.
Take a picture of the fragment on your phone that might be uploaded to a cloud.
Give it to a retainer who might inadvertently upload the fragment to a cloud.
Put the fragment file on a domain joined machine that might back the file up on a cloud.

I know more than one person who eventually lost everything in an address because some SIM swap attack granted the attacker access to their cloud account and a private key or its fragments were on there, intentionally or otherwise. You only have to be paranoid on this once, do it right.

Hardware Wallet Backups

An alternative to storing key fragments on metal as above is to simply not store them outside the hardware wallet at all but to initialize backup hardware wallets instead. This entirely removes the paper wallet or metal plate aspect which is convenient. You can load the private key onto a few hardware wallets and you can optionally Shamir’s the hardware wallet password to allow your assets to be recovered by another person.

The downsides to this if you are using a Ledger or Trezor are you are going to end up with like 6-12 hardware wallets eventually this way and if you ever want to upgrade your hardware wallet you won’t be able to port the address so you’ll need to migrate all your assets between wallets. That’s not only a hassle and annoyingly pricey for the hardware, it hurts your Sybil resistance and address reputation scores in Defi. It also doesn’t apply to documents other than the private key. If you’re using a Grid+ Lattice then they have a SafeCard system that isolates just the password protected the private key and the wipe mechanism from the hardware wallet so you’re not buying multiple tiny computers to safeguard each account. I can’t speak to the hardware safety aspect of the SafeCards but just looking at them does make me feel uneasy thinking of how much money they safeguard protected by a 3 in a million chance of guessing the pin and what looks to be a little chip I wouldn’t be shocked someone could read and virtualize before brute forcing the unlock. I’ll update this sentiment sometime after I have a chance to talk to Grid+ about their system more.

If the only place your private key is is within the hardware wallet it’s probably at least worth asking how safe are hardware wallets? Pretty damn good actually. Most (all?) have a mechanism to wipe the key if they are tampered with. That should keep you safe from all but nation state actors. For the less technically skilled attackers, most hardware wallets wipe the key after three failed attempts. If your unlock password is 6 digits for a Grid+ Lattice or 8 for a Ledger Nano that’s a 3 in a million to 3 in a hundred million chance. Better than lottery odds so don’t go leaving them lying around in any case.

Secrets Versus Private Keys

Everything I talk about above can be used to secure a private key. However, everything past mnemonic phrases can also be used to secure an arbitrary string. You can encrypt a file like a zip or virtual drive this way but the size of a Shamir key grows with the size of the file. A more scalable approach is to encrypt an AES key. Practically this means Shamir encrypting either a key file or the password used in a command like this.

openssl aes-256-cbc -e -in AllOfLogrisSecrets.7z -out AllOfLogrisSecrets.7z.enc

This way you can effectively store unbounded data such as multiple private keys, legal documents, instructions to inheritors, etc. This is akin to using a password manager that uses a single password to unlock numerous other passwords. A side benefit to this is even if the various metal engraving stores conspire to reconstruct my decryption key, they would still need the encrypted file that was never in their possession to do any harm.

Split Accounts

For the more technically inclined I can even improve on the scheme above a little further using a public/private key pair rather than a symmetric key. This allows you to store the decryption (private) key as a secret using the method above but keep the whole public key in your vicinity so you can create new blockchain accounts and secure them without having to first reassemble the decryption key. It helps the maintainability of this system.

Making metal plates for each new address just gets expensive and annoying; as does managing a dozen Ledger’s. Securing an AES private key instead allows you to update the file contents without needing to update or reassemble your master secret.

Why split assets amongst different accounts if they are protected by the same secret? There are several reasons to have distinct accounts.

To keep assets anonymized you might not want the same address holding your logristhebard.eth ENS to reveal everything about your finances.
ERC-20 approvals only apply to a single account. By keeping your cold storage account free of approvals you greatly limit the amount of damage you can do when interacting with Defi regularly.
A more obscure one that came up for me is you might have assets with different tax treatments depending on where they are sourced or if you administrate a self-directed IRA.

To anyone getting lost, here’s a flow to recover the private key that combines everything above.

All that said, all of these physical intrusion scenarios are far, far less likely than electronic attacks. I have never known someone that had their safety deposit box broken into and lost their assets because of it. I have known several in my communities who had their Google Account compromised that inadvertently had a private key on there, their Metamask compromised which gave the attacker the key to their paper wallet or allowed the attacker to send a bad transaction to the hardware wallet, or interacted with a compromised frontend so Metamask receives a malicious transaction that they didn’t carefully review before signing it. Software and social engineering attacks are orders of magnitude more likely than everything else and they are the hardest thing to systemically safeguard against. They allow your attacker to attack you with impunity. The former is the most scalable attack vector and so it is prolific. The latter usually happens to you when you reach out for troubleshooting help on some Discord. The vast majority of hacks rely on the weakest link in this whole chain: you.