C4 C4 Wallet Security & Key Management 2

Question 1

What attack involves a malicious actor replacing a legitimate wallet address displayed in an application with their own address?

Accepted Answer

Address substitution / clipboard hijacking attack

Answer

Clipboard hijacking malware monitors the clipboard and silently replaces copied cryptocurrency addresses with the attacker's address.

Question 2

Which key management practice does C4 recommend for long-term storage of significant cryptocurrency holdings?

Accepted Answer

Using a reputable hardware wallet with an offline, encrypted backup of the seed phrase

Answer

C4 best practices recommend hardware wallets paired with secure, offline backups (e.g., metal seed plates) for long-term significant holdings.

Question 3

What is key stretching as applied to cryptocurrency wallet passphrases?

Accepted Answer

Using a computationally intensive function (e.g., PBKDF2) to derive a key from a password, slowing brute-force attacks

Answer

Key stretching functions like PBKDF2 (used in BIP39) apply thousands of iterations to make brute-force attacks against passphrases computationally expensive.

Question 4

What is the risk of storing a seed phrase digitally in a photograph or note-taking app?

Accepted Answer

Cloud sync or app compromise can expose the seed phrase to attackers

Answer

Cloud-synced apps can be hacked or compromised, exposing the seed phrase and allowing an attacker to drain the wallet completely.

Question 5

What is Shamir's Secret Sharing (SSS) as applied to cryptocurrency key backup?

Accepted Answer

A cryptographic scheme that splits a secret into multiple shares, requiring a threshold number to reconstruct it

Answer

Shamir's Secret Sharing splits a secret (such as a seed) into N shares, where any defined threshold K shares can reconstruct the original secret.

(C4) CryptoCurrency Certification Consortium Practice Test

(C4) CryptoCurrency Certification Consortium Practice Test

C4 C4 Wallet Security & Key Management 2