C4 C4 Wallet Security & Key Management 2 — Questions and Answers
Question 1: What attack involves a malicious actor replacing a legitimate wallet address displayed in an application with their own address?
- Sybil attack
- Address substitution / clipboard hijacking attack (Correct answer)
- 51% attack
- Replay attack
Correct answer: Address substitution / clipboard hijacking attack
Clipboard hijacking malware monitors the clipboard and silently replaces copied cryptocurrency addresses with the attacker's address.
Question 2: Which key management practice does C4 recommend for long-term storage of significant cryptocurrency holdings?
- Storing the seed phrase in a cloud password manager
- Using a reputable hardware wallet with an offline, encrypted backup of the seed phrase (Correct answer)
- Keeping funds on a regulated exchange for insurance
- Using a mobile hot wallet with biometric authentication only
Correct answer: Using a reputable hardware wallet with an offline, encrypted backup of the seed phrase
C4 best practices recommend hardware wallets paired with secure, offline backups (e.g., metal seed plates) for long-term significant holdings.
Question 3: What is key stretching as applied to cryptocurrency wallet passphrases?
- Increasing the length of a private key
- Using a computationally intensive function (e.g., PBKDF2) to derive a key from a password, slowing brute-force attacks (Correct answer)
- Distributing key shards across multiple locations
- Encoding the key in a different format
Correct answer: Using a computationally intensive function (e.g., PBKDF2) to derive a key from a password, slowing brute-force attacks
Key stretching functions like PBKDF2 (used in BIP39) apply thousands of iterations to make brute-force attacks against passphrases computationally expensive.
Question 4: What is the risk of storing a seed phrase digitally in a photograph or note-taking app?
- The seed phrase may become corrupted over time
- Cloud sync or app compromise can expose the seed phrase to attackers (Correct answer)
- Digital storage is slower to access in an emergency
- The seed phrase format may not be recognized
Correct answer: Cloud sync or app compromise can expose the seed phrase to attackers
Cloud-synced apps can be hacked or compromised, exposing the seed phrase and allowing an attacker to drain the wallet completely.
Question 5: What is Shamir's Secret Sharing (SSS) as applied to cryptocurrency key backup?
- A method to share a public address with multiple parties
- A cryptographic scheme that splits a secret into multiple shares, requiring a threshold number to reconstruct it (Correct answer)
- A multi-party computation protocol for signing
- A standard for encrypting backup files with AES-256
Correct answer: A cryptographic scheme that splits a secret into multiple shares, requiring a threshold number to reconstruct it
Shamir's Secret Sharing splits a secret (such as a seed) into N shares, where any defined threshold K shares can reconstruct the original secret.
Question 6: Why should cryptocurrency users verify wallet software downloads using cryptographic signatures provided by developers?
- To confirm the wallet supports their preferred blockchain
- To ensure the downloaded binary has not been tampered with or replaced by a malicious version (Correct answer)
- To activate premium features in the wallet
- To register the wallet with the developer's support team
Correct answer: To ensure the downloaded binary has not been tampered with or replaced by a malicious version
Verifying GPG/PGP signatures confirms the software comes from the legitimate developer and has not been modified by a third party (supply chain attack).
C4 C4 Wallet Security & Key Management 2
What attack involves a malicious actor replacing a legitimate wallet address displayed in an application with their own address?