Private Key Management Flashcards
6 cards from real Blockchain Technology practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Private Key Management flashcards as text
An enterprise wants to manage its cryptocurrency assets with a high degree of security, ensuring no single employee can transfer funds unilaterally. They decide on a wallet configuration that requires 3 out of 5 designated managers to approve any transaction. What type of private key management scheme is this?
Answer: A multi-signature (multisig) wallet
A multi-signature (multisig) wallet is designed to require more than one private key to authorize a transaction. By setting up an M-of-N scheme (in this case, 3-of-5), it distributes control and eliminates a single point of failure, which is ideal for corporate governance.
A developer is building a crypto wallet application and wants to simplify the backup and recovery process for users. Instead of requiring users to back up every new private key generated, the wallet should allow full recovery from a single mnemonic seed phrase. Which wallet architecture should the developer implement?
Answer: Hierarchical Deterministic (HD) wallet
Hierarchical Deterministic (HD) wallets, defined by standards like BIP-32, generate all private and public keys from a single master seed. This means a user only needs to back up the initial seed phrase (typically 12 or 24 words) to restore the entire wallet, including all past and future addresses and keys. Non-deterministic wallets generate keys randomly, requiring each one to be backed up individually.
Which of the following is the PRIMARY security advantage of using a Hardware Security Module (HSM) for private key management?
Answer: Private keys are generated, stored, and used within a tamper-resistant device and never exposed to the host system.
The core security principle of an HSM is that it acts as a dedicated, hardened crypto processor. Private keys are generated, managed, and used for cryptographic operations (like signing transactions) entirely within the secure physical boundary of the HSM. They are never exposed in plaintext to the host computer's memory or operating system, which protects them from software-based attacks, malware, and unauthorized access.
A user wants to create a highly resilient backup of their main private key without storing the full key in any single location. They use a cryptographic algorithm to split the key into 5 'shares', where any 3 of the shares can be combined to reconstruct the original key, but 2 shares reveal nothing. This method is an implementation of what concept?
Answer: Shamir's Secret Sharing (SSS)
Shamir's Secret Sharing (SSS) is a cryptographic algorithm designed specifically for this purpose. It allows a secret (like a private key) to be divided into multiple parts, or shares. The original secret can only be reconstructed when a minimum threshold (k) of shares are brought together out of the total number (n) created. Possessing fewer than the threshold number of shares provides no information about the secret.
When securing a private key, what is the most significant risk associated with storing it unencrypted in a file on a cloud storage service (e.g., Google Drive, Dropbox)?
Answer: An attacker compromising the cloud account gains direct access to the key.
Storing a private key in plaintext on any internet-connected service, including cloud storage, makes it highly vulnerable. If an attacker compromises the user's cloud account through phishing, credential stuffing, or other means, they can immediately access and steal the private key, giving them full control over the associated crypto assets. While other options are valid concerns, the direct threat of theft via account compromise is the most significant and immediate security risk.
Which of the following describes a non-deterministic wallet, also known as a JBOK ('Just a Bunch Of Keys') wallet?
Answer: A wallet where each key is generated randomly and independently, requiring a separate backup for each one.
A non-deterministic wallet generates each private key from a separate random number. The keys have no mathematical relationship to each other. Because of this independence, if a user generates multiple keys (and therefore addresses), they must back up each private key individually. Losing the wallet file without a backup of a specific key results in the permanent loss of funds associated with that key.