A decentralized currency, not accessible to any bank, state, or authority - that is the idea behind Bitcoin. First described in 2008, Bitcoin is still the best-known use case of the so-called distributed ledger technology (DLT), but it is by no means the only one. “Distributed ledger” means exactly what is says: The term refers to a database for transactions that is stored on many computers. Thus, it is not managed from one single place, but rather by many users in a decentralized fashion. "There has been an absolute hype around distributed ledger technologies in various industries since 2014," explains Guthoff.
Far more familiar to many people than DLT is the term “blockchain”. Blockchain is one of the best-known distributed ledger technologies. It provides also the basis for cryptocurrencies. "The name comes from the fact that, in a blockchain, blocks of data are stored one after another. Blockchain applications such as Bitcoin or Ethereum are based on the same technology, but they follow different rules," explains Guthoff. The goal, however, is always to have a currency that facilitates online payments entirely without the involvement of any financial institution.
Single-user scenario for cryptocurrencies is outdated
With this original idea in mind, it is hardly surprising that a service and management system has formed around cryptocurrencies that is geared toward individual users. This is also true for the management of cryptographic keys, which is essential for the processing of transactions in a blockchain. Every financial transaction between two trading partners on the blockchain has to be documented in detail. It is also visible and traceable for all users. This is the only way to ensure that the system as a whole remains trustworthy and reliable. In addition to a public key, cryptocoin owners also own a private key with which they can access their digital wallet and digitally sign transactions. These private keys are 52 characters long and randomly assigned to users. If such a key is lost, the cryptocurrency associated with the key is also irretrievable lost. Secure storage of private keys is therefore essential.
Study provides design ideas for key management in multi-user scenarios
The requirements for secure management and storage of cryptographic keys grow when multiple users need access to the keys. "By default, this is the case for crypto funds, for example. Since a change in the law in 2022, such funds have become a bigger issue in financial institutions in Germany and, as with other funds, they are usually managed by several employees. In addition, employees must be able to cover for each other in the event of vacation or illness," explains Guthoff. She did a survey with 13 employees in financial institutions enquiring about the security and confidentiality requirements the institutions had for key management and the optimal key management envisioned by employees. "The results of this study can help design key management solutions that meet the needs of financial institutions, that are secure yet practical."
In practice, employee turnover is one of the biggest challenges for key management with multiple users. "Once an employee had access to a key, there is the risk that they have copied it. In that case, they can still access the assets, even if they have resigned in the meantime or hold a different position," says Guthoff. A good solution to this problem, according to some study participants, might be a program that allows keys to be used for transactions but does not allow direct access to the key itself. "Across the board, participants overwhelmingly wanted technical solutions for storing keys that could be secured by multiple factors, such as TANS and passwords."
Another important question is how to deal with liability and responsibility issues. Many of the respondents think that models for optimal key management and for the allocation of access rights to assets should correspond to the organizational structure of their company. "This means, for example, that CEOs have access to higher assets than ordinary employees and should be given extended access rights," Guthoff explains. Most respondents also wanted key management that did not require too much background knowledge of digital signatures and that was easy to use. Some respondents found it useful to involve an intermediary between the financial institution and the trading platform who could take over key management and its security, provided there was an appropriate relationship of trust.
Many exciting research questions
For CISPA researcher and PhD student Carolyn Guthoff, this was the first paper she submitted to a conference. "That my paper was accepted at the prestigious S&P is wonderful. It encourages me." Despite her recent deep dive into cryptocurrency, Guthoff is not planning to focus her research on financial topics in the future. "Working on this topic was super exciting, but now I will turn to other research questions. I'm particularly interested in topics where the ideas and demands of security researchers and the realities of users' lives don't really fit together." There are probably still a few of those.
You can read Guthoff’s entire paper here:
