Lions, and Tigers and Bears, oh my! Hot and Cold Storage, Hierarchical Wallets, and Brain Wallets, Oh my!

Last time, I just discussed local storage. I listed several options for storing bitcoins and I talked about storing bitcoin from a security, availability, and convenience standpoint. This lecture is again looking at different key management system but from the idea of access to the internet/blockchain. I talk about hierarchical wallets, brain wallets, and paper wallets. I would say “All the wallets” but there are more wallets to come…

Questions answered in this Post:

• What is cold and hot storage? How does that influence what wallet I choose?
• This cold storage seems cool. Can I make it myself?
• Why would you and how can you transfer coins from hot to cold and vice versa?
• What is this hierarchical wallet? Is it similar to a hierarchical deterministic wallet?
• What is a deterministic wallet? Has it been implemented and where?
• What are the mechanisms used to do cold storage?
• What is a brain wallet?
• What is a tamper-proof seal device and give an example.

Hot and Cold Storage

If you have worked in technology the words hot and cold storage may have popped up before. Hot storage simple means it’s connected to the internet and thus has the opportunity to be considered risky. Thus when you put your key management on a internet connected computer, phone, or a browser, this would be hot storage. Hot storage is not bad; it is even necessary if you want to conveniently make transactions. Cold storage is when the key management that is offline and can be considered more archival. That paper wallet is a form of cold storage. Also, if you manage your keys on a non internet device, this is also cold storage.

I saw quite a few tutorials online showing how to create a cold storage device. I’ve listed them below since I thought it was interesting.

1. Using Old Cellphone as Cold Storage: These instruction show how you can use an old cellphone as a cold storage device. It is a bit difficult to follow but there is a video here.
2. Creating a Bitcoin Cold Storage Wallet: This creates a cheap cold storage wallet using Mycelium. The phone was an android phone.
3. Creating a USB Bitcoin Wallet with MultiBit: This tutorial shows you how to make an encrypted USB Bitcoin Wallet.
4. RavenBit: DIY Physical Bitcoin: This company actually sends you a brass coin.
5. Cold Storage Paper: This tutorial came from Bitcoin.com where they describe creating a secure paper wallet.

Remember
Hot- online convenient but risky
Cold – offline archival but safer

 

Now that we know what hot and cold storage means, why did the people from Princeton devote an entire lecture to them and transferring bitcoin between each system? It is because it is something that will be necessary for owners and is non trivial. Suppose you get quite a bit of bitcoin via gambling in your hot storage and you need to offload that amount to your cold storage. You’ll need to transfer the coin from the hot key address to the cold key address. This can all be done with the cold storage offline, so this is an easy move. However, let us say you have been having a terrible gambling run and you have depleted your hot storage wallet. You can A. Quit and decide you’re done or B. Get more bitcoin into your account by transferring some of your secured funds from the cold storage to the hot.

 

How can you transfer from cold to hot if you’d prefer to keep your cold storage device offline for security? Likely, you’ll want to receive coins in a separate address with different secret keys each time, thereby requiring some mechanism to actively generate new fresh cold addresses each time. Having new addresses improves anonymity since someone cannot be identified for having several transactions between a single address. Also, if one private key is compromised, it’s good to have other options.

A very simple approach reminds me of a feature in Gmail. With Gmail, you can set up 2-Factor Authentication. (If you don’t have 2-Factor Auth set up, do it now!) 2-Factor Authentication means that when you log in, you submit your password but then you have to submit a second code. This enables better security since that second code is usually sent to a device that thwarts hackers from just brute forcing your password. This means every time you log into your Gmail, you type your password and then Google sends a code to you via email or text message. There are times when you’re not online or you’re traveling where that secondary device is just unavailable. At moments like that, Google allows you to print a list of codes and just use those codes to log in. These codes can be printed out before your trip and you’ll take this sheet of paper with you so that when you want to check your Gmail, you’ll use these codes as a replacement for that second code.

Thus cold storage can just generate a bunch of addresses and send them to the hot storage. The only problem is that periodically, the cold storage device will have to go online to generate and deliver a new set of codes to the hot storage.

This is where hierarchical wallets come into play.

Hierarchical Wallet

A hierarchical wallet allows the cold storage side to have an unbounded number of addresses and the hot side knows these addresses vi a short, one time communication between the both sides. This sounds perfect!

I’ll explain how it works as well as I understand it. We will still be using the ECDSA scheme since it has special properties which I”ll touch upon later. For hierarchical wallet, key generation is slightly modified. Regular key generate (generateKey) creates a public key (address) and a secret key. Instead, the generate key creates a public and private key generation info. With the generation info and an index number, you can generate the ith address in the sequence.

With this “generation info”, you can create a sequence of addresses instead of just one. The cool part is that the address generation info does not leak information regarding private keys so giving people the index and generation info is reasonably safe. The reason this works is because ECDSA supports hierarchical key generation. Now as long as the hot and cold side know the right sequence number, you can generate addresses from the hot side and private keys on the cold side. Also, the public key are not linkable meaning that even if you figure out one, you can just reverse engineer in some way to get the rest of them an that the private keys are still safe.

Now you must be thinking, where is this hierarchical, I just see two different sides hot and cold? There can actually be more levels with this wallet. Currently the hot side is the lower level while the cold is the top level. As with a company employee chain, the higher the chain the more secure you want the communication chain.

(HIerarchical) Deterministic Wallets

While this word was not mentioned in the lecture, I think it is worth mentioning deterministic wallets. A deterministic wallet allows the user to generate data for their keys from a single seed instead of randomly generating them The nice benefit of the deterministic wallet is that you can recreate your lost keys if say your hard drive gets corrupted as long as you know this seed. Honestly, to me this sounded just like hierarchical wallet ie a special generateKey function. Within the article that I linked to, when the author, Buterin explain the wallet, it sounds exactly the same as the hierarchical just with different words. If you read the article, just substitute the word generation info with master public key.

I’ve also listed several links that either talk about hierarchical deterministic (HD) wallets or are implementation of HD wallets. Just know, many wallets nowadays do implement this feature. Hierarchical Deterministic Wallet (HD) term was more prevalent than just the hierarchical wallet. I feel like the lecturers may have chosen a less used term to explain this feature.

• Understanding Hierarchical Deterministic Wallets – This youtube video by LTB Network features a podcast type explanation of the different wallets. It is about an 11 minute video. He explains the BIP: 32 in a nice clear fashion.
• Hierarchical Deterministic Wallets BIP: 32 – This links contains the exact Bitcoin Improvement Protocol (BIP) for adding HD wallets. It is a technical read but incredibly informative.
• Electrum Protocol – This company which I listed last week as a bitcoin wallet. As mentioned from Bitcoin Magazine, the wallet full implement BIP32 making it a Hierarchical Deterministic Wallet
• TREZOR – This is another bitcoin wallet that implements HD wallet. Different from other wallets discussed, this is a hardware wallet. Thus when you buy TREZOR, they will send you palm sized, tamper and water- proof device which is your wallet.
• Armory Deterministic Wallet – I mentioned this company last time as being a security conscious bitcoin wallet. They have a neat implementation for a deterministic wallet.

Now, I know I listed some practical ways to do cold storage. I listed those DIY resources on how to make your phone, paper, or USB device into a cold storage. These methods incorporate methods such as brain wallets, paper wallet, and tamper-resistance devices. A paper wallet sometimes contains a tamper-evident seal over the private key. This makes sure there is not way to output or divulge the key. A brain wallet secures the bitcoins by a secret passphrase which I’ll discuss below.

Brain Wallets

A brain wallet is nice because you don’t need to have extra hardware to store your bitcoins. You only need to have a good memory or an effective but secure way to determine your passphrase. Once you have a good passphrase, then you can just hash it twice, maybe using SHA-256 to give you a secure public and private key. Now your password while it may look random, if the adversary knows how you generated the key and your passphrase, you will be at a loss. With your email, if someone puts into too many password, you can locked out, this does not happened with bitcoin. Thus if your passphrase is common, hackers can just use something called offline guess or password cracking to steal your coins. The lecture does discuss one way to do passphrase generation.

You just choose a random sequence of 6 random words from among the top 10,000 works in the English language. They are easy to remember and have roughly 80 characters. From there, use a hash function SHA-256 and compute is 2^20 times to just make it hard for the attacker.

Key Stretching – use a deliberately slow function to derive the private key from the passphrase to make it harder for attackers to brute force.

Metamask.io is a Chrome plugin. Besides having a cute evil fox, they use this brain wallet approach. When you create your new vault, as they call it, they give you 12 words that allows you to restore your MetaMask accounts for the vault. So you’ll be given words like “retreat brain math envelope earth dutch fake tired dot occasions worn focusing” which you need to store and use to recover your accounts.

There is one downside, if you forget the passphrase, you’re screwed…

4 Ways to do Cold Storage

1. Information stored in device, device locked
2. Brain wallet encrypt info under passphrase or password that a user remembers
3. Paper wallet -print info on paper, lock up the paper
4. “Tamper-proof device” device will sign things for you but won’t divulge keys

Wrap-Up

I’ve wrapped up below what I’ve talked about because it combined several components. I first discussed why there is a need for hot and cold storage as well as why you would want to transfer coins between these storage components. Additionally, I gave some links to tutorials on how to create a cold storage device. Next, I walked through how hierarchical wallets work. Next, I discussed deterministic wallets since this term is more actively used than hierarchical  wallet. Lastly, I discussed, what methods are used to do cold storage which involve offline devices, brain wallets, tamper-proof devices, and paper wallets.

Which of the following statements are true about cold wallet storage
Cold storage keys in device without network access
hot storage wallets can generate arbitrarily many cold storage addresses without contacting the cold storage