Imagine giving someone a locked box filled with valuable items, and instructions on how to send you messages about it - but you keep hold of the only key that opens it. This is how public-key cryptography works, the mathematical basis that enables secure electronic transactions in our globalized business environment. Fundamentally, the security aspect of cryptocurrency is based on a great mathematical idea known as asymmetric cryptography, in which two cryptographically related keys are used simultaneously to establish an unbreakable security system. These keys are not an academic curiosity, but the only way to move safely in the crypto world and not to become a victim of hacks or phishing. The Mathematical Foundation The cryptography of public keys is based on mathematical problems which are simple to resolve in one direction but nearly impossible to undo without special information. Imagine it as mixing up colors. Combining blue and yellow to make green can be easily done, but when someone is presented with a sample of green paint, determining the precise amounts of blue and yellow used is hard. Cryptocurrency is most often mathematically based on so-called elliptic curve cryptography (ECC). Without going into great depths over calculus, elliptic curves are mathematical equations that do not provide straight lines on the graph but make up certain curved lines. The curves are special in the sense that they are ideal in cryptography. Now for the magic! Choose a random point on this curve, and perform a mathematical process known as scalar multiplication a billion times. Your private key will be the starting point and your public key will be the end product. It is mathematically straightforward to compute the public key out of the private key, but going the other way—computing the private key out of the public key—would involve solving what mathematicians refer to as the discrete logarithm problem. In perspective, despite the fastest computers in the world today, cracking a well-generated private key would require time that is equivalent to the age of the universe. This is the mathematical one-way street which crypto security is built on. How Private Keys Work Your private key is an extremely large random number and is usually 256 bits long. That is approximately 77 digits in decimal notation—bigger than the number of atoms in the visible universe. The size of this astronomical number guarantees that the probability of generating the same private key twice is practically zero. It is your signature and proof of ownership. To transfer cryptocurrency, you make a digital signature using your personal key that can verify that it is you who owns the money. This signature is unique for every transaction and it cannot be reused or reverted. Consider your personal key the secret code to all of your crypto-wealth. In comparison to the old days when you could call customer service and get help retrieving a lost password, being without a private key means that you will never be able to access your money again. This has resulted in countless tales of misfortune, with some estimates suggesting that up to 20% of Bitcoin could be lost forever due to misplaced private keys. Generation of private keys normally occurs by cryptographically secure random number generators, where different sources of entropy such as mouse activities, keyboard hits and system noises are used to guarantee the independence. Any vulnerability of this randomness may lead to a security attack, and that is the reason why trusted wallet software employs more than single sources of entropy. The Role of Public Keys Although your private key should be kept completely confidential, your public key should be distributed freely. The public key is a mathematical derivation of your own private key using elliptic curve algorithms, and it carries out several important purposes in the cryptocurrency world. Your public key will enable other people to confirm that you have signed transactions that are legal without exposing your private key. By sending you cryptocurrency, a person is essentially asking you to solve a mathematical puzzle. It is only your personal key that will provide you with the ability to do so, but any other person will be able to confirm whether you have completed the mathematical task correctly. They can do so using your public key. In the majority of cryptocurrencies, your public key is not your receiving address. Rather, it undergoes further mathematical operations referred to as hashing functions in order to generate shorter and easier to use addresses. An example of how Bitcoin addresses are generated is through the use of the SHA-256 and RIPEMD-160 hash functions on your public key, followed by tacking on a few additional characters to detect errors. This extra level has several functions: it produces shorter addresses, offers quantum obfuscation, and allows for different formats that encode additional information about how the funds should be used. Security Implementation in the Real World These theoretical properties of the security of public-key cryptography are only useful when put into operation in real-life systems. This is where client architecture and security in crypto becomes crucial for maintaining the integrity of the entire system. The process of generating, storing and using keys in cryptocurrency wallets and applications has a direct effect on user security. The newest cryptocurrency wallets use multiple security tools to secure the private keys. Hardware wallets keep keys in dedicated chips. These are resistant to tampering. This means that the private key is not exposed to potentially compromised computers. Software wallets can provide user password encryption of private keys, storing them on the client side, and more advanced ones can be based on multi-signature schemes, where multiple private keys are needed to authorize a transaction. The client-side implementation should secure the user interface by never displaying private keys. It should also use random sources of entropy to generate keys and ensure network communications do not transmit any sensitive information. Poor implementation in any of these areas may make mathematically unbreakable security easily exploitable. The Exchange Security Challenge Bitcoin exchanges face unique security challenges when handling millions of users' private keys. Unlike single individuals who could have only one key pair, exchanges are required to acquire thousands or millions of private keys and at the same time be capable of handling withdrawals fast and efficiently. The vast majority of reputable exchanges employ a mixture of both hot and cold storage. Hot wallets, which are linked to the internet in carrying out their daily activities, contain a small percentage of money to be withdrawn at any given time. Most funds are stored in cold trapped-offline systems, which are far less vulnerable to attack but must be accessed manually. Multi-signature security is also practiced by leading exchanges, so large transactions require the authorization of multiple private keys. This implies that if a single key is compromised, attackers cannot loot the money without the other keys that are kept in different and secure places. Although individual key pairs remain mathematically secure, exchanges must not overlook operational security, worker access controls, and the multifaceted challenge of balancing liquidity with security. Misconceptions The key cryptocurrency myth is that the longer the password or more elaborate passphrase, the higher the security level. Although the strength of passwords is important in ensuring the safety of encrypted wallet files, it is the mathematical properties of the key pairs that are central in ensuring safety - not the passwords chosen by the user. The other harmful myth is that cryptocurrency transactions are anonymous. Although your real identity does not necessarily have a direct relation with your public key, all transactions are documented in a public ledger. Sophisticated analysis tools are capable of connecting more than one address to a single user, tracing a path that privacy activists and security experts caution about. Incorrect key storage is also underestimated by a lot of newcomers. Saving the keys in cloud services, mail, or even password managers that are not specifically configured to store cryptocurrency keys are additional risks. These services could expose your keys to hackers. Staying Secure in Practice Understanding cryptocurrency security is just the beginning. Security requires forming good habits and applying the correct tools to your circumstances and level of technical knowledge. The best level of security and usability is offered by hardware wallets. These devices perform the mathematical operations automatically, and your secret keys are never transmitted to suspicious computers. The keys are not stored on a disk, meaning that your keys are secure even if your computer is infected by malware. If you want to learn more about cryptocurrency security and the associated best practices, educational materials such as those from CryptoManiaks are a good place to start. They not only instruct beginners about the fundamentals of wallet security, but also proceed to discuss more advanced topics like multi-signature systems and privacy-saving measures. Technology keeps on changing, so it’s important to keep up with changing security practices. It is also useful to have security audits of your own practices on a regular basis. It involves ensuring that your backup policies are operational, your wallet software is current, and conducting a regular review of your transaction records, to be alerted of any unauthorised activity. The Future of Crypto Security Current cryptocurrency security has strong mathematical underpinnings, yet the field keeps changing. Quantum computing represents a hypothetical future threat to modern elliptic curve cryptography, but quantum computers practical enough to crack the security of cryptocurrencies are years or decades off. The developers of cryptocurrency are already working towards this future by looking into quantum-resistant cryptographic algorithms. Once the need arises, the mathematical foundations could be improved without changing the underlying principles of public and private key pairs. The human factor is the most vulnerable in cryptocurrency security. Even the best mathematical skills will not secure those users who succumb to phishing attacks, use a weak password to encrypt their wallets, or keep their keys in an unsecured place. Good security practices and education are as important as the mathematics behind the keys.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

Quant

Public

Instrument, Then Migrate: Observability Lessons From Mobile Monitoring Vans to Fortune-100 Apps 

What Are Public and Private Keys: An Intro to the Mathematics of Crypto Security

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

3 AI and Analytics Solutions Startups and SMEs Should Use Right Now

Why Machine Learning Loves GPUs: Moore’s Law, Dennard Scaling, and the Rise of CUDA & HIP

How to Contribute to GitHub Without Breaking Anything

$1B Capitalization: Meme Token Launch Strategy Under the Microscope

(1/100) Crypto Countdown: Golem

06/09/2018: Biggest Stories in the Cryptosphere

3 AI and Analytics Solutions Startups and SMEs Should Use Right Now

Why Machine Learning Loves GPUs: Moore’s Law, Dennard Scaling, and the Rise of CUDA & HIP

How to Contribute to GitHub Without Breaking Anything

$1B Capitalization: Meme Token Launch Strategy Under the Microscope

(1/100) Crypto Countdown: Golem

06/09/2018: Biggest Stories in the Cryptosphere

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps