Free Blockchain Security Training Private Key Management Questions and Answers — Questions and Answers
Question 1: An enterprise wants to manage its cryptocurrency assets with a high degree of security, ensuring no single employee can transfer funds unilaterally. They decide on a wallet configuration that requires 3 out of 5 designated managers to approve any transaction. What type of private key management scheme is this?
- A hierarchical deterministic (HD) wallet
- A multi-signature (multisig) wallet (Correct answer)
- A non-deterministic (random) wallet
- A brain wallet
Correct answer: A multi-signature (multisig) wallet
A multi-signature (multisig) wallet is designed to require more than one private key to authorize a transaction. By setting up an M-of-N scheme (in this case, 3-of-5), it distributes control and eliminates a single point of failure, which is ideal for corporate governance.
Question 2: A developer is building a crypto wallet application and wants to simplify the backup and recovery process for users. Instead of requiring users to back up every new private key generated, the wallet should allow full recovery from a single mnemonic seed phrase. Which wallet architecture should the developer implement?
- Hierarchical Deterministic (HD) wallet (Correct answer)
- Hardware Security Module (HSM)
- Paper wallet
- Non-deterministic wallet
Correct answer: Hierarchical Deterministic (HD) wallet
Hierarchical Deterministic (HD) wallets, defined by standards like BIP-32, generate all private and public keys from a single master seed. This means a user only needs to back up the initial seed phrase (typically 12 or 24 words) to restore the entire wallet, including all past and future addresses and keys. Non-deterministic wallets generate keys randomly, requiring each one to be backed up individually.
Question 3: Which of the following is the PRIMARY security advantage of using a Hardware Security Module (HSM) for private key management?
- It splits the private key into multiple shares for distributed storage.
- It allows for easy recovery of keys using a simple mnemonic phrase.
- Private keys are generated, stored, and used within a tamper-resistant device and never exposed to the host system. (Correct answer)
- It generates human-readable private keys that are easier to remember and use.
Correct answer: Private keys are generated, stored, and used within a tamper-resistant device and never exposed to the host system.
The core security principle of an HSM is that it acts as a dedicated, hardened crypto processor. Private keys are generated, managed, and used for cryptographic operations (like signing transactions) entirely within the secure physical boundary of the HSM. They are never exposed in plaintext to the host computer's memory or operating system, which protects them from software-based attacks, malware, and unauthorized access.
Question 4: A user wants to create a highly resilient backup of their main private key without storing the full key in any single location. They use a cryptographic algorithm to split the key into 5 'shares', where any 3 of the shares can be combined to reconstruct the original key, but 2 shares reveal nothing. This method is an implementation of what concept?
- M-of-N multi-signature
- Hierarchical key derivation
- Key wrapping with a password
- Shamir's Secret Sharing (SSS) (Correct answer)
Correct answer: Shamir's Secret Sharing (SSS)
Shamir's Secret Sharing (SSS) is a cryptographic algorithm designed specifically for this purpose. It allows a secret (like a private key) to be divided into multiple parts, or shares. The original secret can only be reconstructed when a minimum threshold (k) of shares are brought together out of the total number (n) created. Possessing fewer than the threshold number of shares provides no information about the secret.
Question 5: When securing a private key, what is the most significant risk associated with storing it unencrypted in a file on a cloud storage service (e.g., Google Drive, Dropbox)?
- The file could be accidentally deleted by the user.
- The cloud provider could suffer a data-loss event, destroying the key.
- An attacker compromising the cloud account gains direct access to the key. (Correct answer)
- The file format may become obsolete and unreadable in the future.
Correct answer: An attacker compromising the cloud account gains direct access to the key.
Storing a private key in plaintext on any internet-connected service, including cloud storage, makes it highly vulnerable. If an attacker compromises the user's cloud account through phishing, credential stuffing, or other means, they can immediately access and steal the private key, giving them full control over the associated crypto assets. While other options are valid concerns, the direct threat of theft via account compromise is the most significant and immediate security risk.
Question 6: Which of the following describes a non-deterministic wallet, also known as a JBOK ('Just a Bunch Of Keys') wallet?
- A wallet that requires multiple users to sign a transaction.
- A physical device that stores private keys offline.
- A wallet where each key is generated randomly and independently, requiring a separate backup for each one. (Correct answer)
- A wallet that derives a tree of keys from a single master seed phrase.
Correct answer: A wallet where each key is generated randomly and independently, requiring a separate backup for each one.
A non-deterministic wallet generates each private key from a separate random number. The keys have no mathematical relationship to each other. Because of this independence, if a user generates multiple keys (and therefore addresses), they must back up each private key individually. Losing the wallet file without a backup of a specific key results in the permanent loss of funds associated with that key.
Free Blockchain Security Training Private Key Management Questions and Answers
An enterprise wants to manage its cryptocurrency assets with a high degree of security, ensuring no single employee can transfer funds unilaterally.
They decide on a wallet configuration that requires 3 out of 5 designated managers to approve any transaction.
What type of private key management scheme is this?