CCE Wallets and Asset Security 3 — Questions and Answers
Question 1: What is a 'brain wallet' and its primary security weakness?
- A wallet memorized as a passphrase, weak because human-chosen phrases are predictable (Correct answer)
- A hardware wallet with biometric unlock, weak because fingerprints can be copied
- An air-gapped device, weak because it cannot receive firmware updates
- A custodial wallet, weak because the provider holds the keys
Correct answer: A wallet memorized as a passphrase, weak because human-chosen phrases are predictable
Brain wallets derive keys from memorized passphrases, but humans choose predictable phrases that attackers can brute-force with dictionary attacks.
Question 2: What does 'dusting attack' refer to in cryptocurrency security?
- Sending tiny amounts of crypto to addresses to de-anonymize wallet owners (Correct answer)
- Overloading the mempool with small transactions to delay confirmations
- Injecting malicious data into transaction metadata
- Using mining dust particles to contaminate ASIC hardware
Correct answer: Sending tiny amounts of crypto to addresses to de-anonymize wallet owners
Dusting attacks send minuscule amounts to many addresses; when victims move these funds, attackers can cluster addresses and link identities.
Question 3: Which feature distinguishes a 'stateless' hardware signer from a traditional hardware wallet?
- It requires no physical button confirmation
- It stores no keys on the device itself between sessions (Correct answer)
- It connects directly to the internet for signing
- It generates keys from the block hash at time of creation
Correct answer: It stores no keys on the device itself between sessions
Stateless signers (like some air-gapped devices) derive keys on demand from an externally held seed and store nothing persistently on the device.
Question 4: What is the purpose of a 'passphrase' (25th word) added to a BIP-39 seed?
- It replaces the 24-word mnemonic entirely
- It creates a completely different wallet, adding plausible deniability and extra security (Correct answer)
- It encrypts the seed on the hardware device's storage
- It is required to unlock the device PIN
Correct answer: It creates a completely different wallet, adding plausible deniability and extra security
A BIP-39 passphrase acts as an extra factor; any passphrase (including empty) produces a valid but different wallet, enabling plausible deniability.
Question 5: In the context of cold storage, what does 'air-gap' mean?
- The device uses Bluetooth with a 300m range restriction
- The signing device has no network connectivity at any point (Correct answer)
- Transactions are delayed by a 24-hour air-gap period
- The device operates in a temperature-controlled environment
Correct answer: The signing device has no network connectivity at any point
An air-gapped device is physically isolated from all networks, ensuring private keys cannot be exfiltrated remotely.
Question 6: What is 'key stretching' as used in wallet encryption?
- Extending a private key to support longer transaction messages
- Applying a computationally expensive hash function to slow brute-force attacks on passwords (Correct answer)
- Increasing the bit length of a seed phrase
- Distributing key material across multiple blockchain addresses
Correct answer: Applying a computationally expensive hash function to slow brute-force attacks on passwords
Key stretching (e.g., PBKDF2, bcrypt) repeatedly hashes a password to make brute-force attempts computationally expensive.
Question 7: Which type of wallet vulnerability does a 'supply chain attack' specifically target?
- Wallets that use weak RNG for key generation
- Hardware or software wallets compromised before they reach the end user (Correct answer)
- Wallets exposed to public Wi-Fi networks
- Wallets with outdated firmware that miss security patches
Correct answer: Hardware or software wallets compromised before they reach the end user
Supply chain attacks compromise the manufacturing, packaging, or distribution of hardware wallets so devices arrive pre-backdoored.
CCE Wallets and Asset Security 3
What is a 'brain wallet' and its primary security weakness?