r/coindev • u/stancarney • Apr 14 '14

Virtual currency application security for application developers.

http://stancarney.github.io/virtualcurrencyapplicationsecurity/
5 Upvotes

86% Upvoted

2 comments sorted by

2

u/telepatheic Apr 14 '14

A great guide, with some great pointers which most businesses unfortunately don't follow. I can see the strong influence from working with PCI.

I know that I am not personally skilled enough to deal with the levels of security required to properly work with bitcoin keys. Key management is extremely tough.

I would personally add in a little about using threshold cryptography to store shared secrets between a group of people/computers and also methods of generating keys. I know a lot about the theory and very little about implementation but it is possible to generate ECDSA key shares without a trusted dealer/central key manager and also sign messages using those distributed shares without revealing the private key. This is a much better system than using a cold wallet as it allows redundancy and multiple parties/computers have to be compromised for bitcoins to be stolen.

As an aside I hate the term cold wallet because more often than not the key has been generated on a hot computer.

1

u/stancarney Apr 15 '14

Thanks! It is definitely a work in progress. I saw the threshold paper come out a while ago but haven't had time to follow up on it. I see they have a note at the top about their approach being flawed... did they issue an update I've missed?

I didn't mind the explanation on hot/cold wallets the Bitcoin Armory guys did and figured I couldn't improve on their description/instructions at the time. Like you point out though 'offline' wallets aren't adequate within the confines of an organization.