Partnered With:

Several methods of science: protect the verifier keys

Read this article in 31 Minutes

This article provides a variety of methods to protect the verifier key, at the same time ensure that they can be used to fulfill their duties of validation.

The original title: "popular science | protection verifier. Several methods of key"

Source: Ethereum enthusiast

We have the most basic understanding of readers default pair of license, including but not limited to what is "verifier", "why do they need key", and "what do they usually need operation" concept.

What is a verifier key?

In ETH 2.0, the verifier key is used to determine which verifier issued the relevant message. Validators need to send these messages to be rewarded (and to avoid punishment).

The risk of a verifier key is difficult to measure: the verifier key itself cannot be used to access the asset. Therefore, even if an attacker obtains your verifier key, there is no way to steal assets directly. However, they can gain indirectly through extortion 1, and even worse, they want you to lose 2 more than they gain themselves. Therefore, we generally consider the security requirements of the verifier key to be high.

- Figure 1: Verifier security requirements -

But, don't like a withdrawal key (you can offline store), validation is a key to be able to take in, because the verifier in each epoch (about 6.5 minutes) multiple messages to be signed. The key access requirements, therefore, is also high.

- Figure 2: Access requirements for verifier keys -

As a result, we find ourselves in a dilemma: traditionally, it has been difficult to meet both security and accessibility requirements, since improving security tends to reduce accessibility, and vice versa.

- figure 3: key dual demand - validation

To meet the demands for safety and accessibility, we need to take more advanced measures, on the premise of no significant compromise, the higher degree to meet the needs of these two aspects. This can be done by stratification. The purpose of this paper is to explore the functionality available within each layer, and understand what function applied to or not to verifier Settings.

The key pairs in Eth2 have a public key and a private key. For the purposes of this article, the term "key" is used throughout this article to refer to what is commonly called a private key; If the public key is referred to, this is clearly stated.

Both Validator Key and Withdrawel Key are key pairs, public and private. The public key is used to register on the Eth1 chain and is publicly available; The private key is actually used by the verifier himself, and cannot be made public. If it is made public, his assets and verifier are completely controlled by others.

Goals and layering

First of all, we need to define the goal of the attacker and the user. After know why want to protect the key, we can think about each function to what extent can achieve this goal. First of all, the attacker's goal can be defined as:

The attacker's goal is to sign a message can checkout with the target when the verifier public key that corresponds to the signature (that is, to forge the verifier signature of a message).

And, of course, if this is the only goal, then directly destroy the verifier key can prevent the attacker. But, it have no help at all for the user. Therefore, we need to consider the second goal, also is the user's goals, can be defined as:

The user's goal is to sign only ideal messages and not bad messages.

In terms of the goal of this article, the ideal news refers to access to the news of the reward, bad news refers to trigger confiscated 3 news events.

Note that the attacker only needs to sign any message to achieve his goal, while the user's goal is persistent. This asymmetry is a hallmark of security systems that the attacker only needs to win once, while the user needs to win every time.

To do this, we need a system that is composed of different layers or separate functions that provide enhanced security or enhanced accessibility, and can combine the two to a high level. A good security model requires multiple layers, each of which (individually or in combination with other layers) provides a backup of some kind of security or other layer, and enough layers to provide accessibility to ensure that the user's goals can be achieved. Note that this article focuses on technical protection: other levels of security (for example, operational and social) are outside the scope of this article, although they are a critical part of any security model and should be addressed accordingly.

layered

To explore the protection of the verifier key, let's first do a simple demonstration:

- Figure 4: Verifier key -

With ETH 2.0 all key authentication key is a string of number four. If the validation in without any protection measures to store the authentication key, an attacker can easily get the keys and achieve its goals. The following several kind of person can get verifier keys:

- any access to run the verifier client computer accounts

- any authorized access to run the verifier the client computer

- Anyone who has physical access to the computer running the verifier client

- Anyone who has access to the computer's data running the verifier client (for example, backup data)

In this way, the user cannot achieve his goal (that is, not to sign bad messages). Therefore, we first need to protect the verifier key by means of encryption:

Key - - figure 5: encryption authentication

We can verifier secret key in a number of ways, for example, EIP 5-2335 standard. Once the validation key is encrypted, unless the attacker to master the encrypted password (passphrase), otherwise unable to decrypt the key 6. So that it can well protect the verifier key (whether it is stored in the validation to the client or the data backup).

At first glance, an attacker may seem unable to achieve his goal in any way. However, there is no way for users to achieve their goals, because they can no longer sign the ideal message: the encrypted key is useless for both the user and the attacker because the user must first decrypt the key before signing the message with it. In this way, the verifier process must include the step of accessing the decryption password. If the verifier process can access the decrypted password, then the attacker can also access the password, especially if the decrypted password is stored on the verifier client, since the verifier client can be attacked.

So this change in itself is not a good idea. However, if we combine it with the second layer, we can provide stronger protection:

- figure 6: remote password -

If the decryption password is stored in the remote, encryption keys will be checked with a more powerful protection 7. Because the password is no longer stored in the verifier client, attacker can not from disk data encryption private key. The attacker can only attack is more complex, for example, from memory after decryption key, or imitate the verifier client process to obtain the decryption key.

Although the attack is more difficult, it is still possible for a complex attack to obtain a verifier key. In addition, users can still inadvertently sign bad messages. Therefore, we can improve security and accessibility for users by adding a layer of remote signers.

Apparatus - - figure 7: remote signature

The remote signer separates the core functions of the verifier client: determining the data to put into the message, signing the message, and sending the message to the ETH 2.0 network. The first and third functions remain in the hands of the verifier client, and the second function is implemented by the remote signer. The remote signer also introduces a forfeiture protection mechanism that can determine which messages are ideal and which are bad, and sign or reject them.

How to prevent the attacker moving target from the verifier client to remote signature device? First of all, the signature can have higher security than the verifier client. Verifier client needs to perform many tasks, including with other part of the ETH 2.0 network communications (such as beacon nodes). These communications can provide an attacker with information and attack interface. Because only the signature and the verifier client communication, their activity is limited by many, it's brought higher security for both sides of the server.

Second, remote signers bring other benefits to users. The same remote signer can now communicate with multiple verifier clients, enabling us to create a highly available verifier client infrastructure. The remote signer ensures that the authenticator client does not sign any bad messages.

However, as a matter of fact, remote signature is a single point of failure problem: if the remote signature was attacked, or malfunction, the user won't even ideal message signature. Is there a way can make remote signature is more resistant to attack, without losing the above any benefits?

- - figure 8: threshold signature

We can also build a threshold signature on top of the above layers to further enhance security and accessibility. The verifier key needs to be handled using the Shamir key segmentation process, that is, multiple keys are generated using the verifier private key and then sent to the remote signer.

- figure 9: Shamir key - segmentation

Now, every remote signature is hold by the verifier private key generated key, and only a few remote signature device can create valid signatures, the so-called threshold signature, threshold signature). Assume that there are three remote signature, two remote signature device providing personal signature to generate an aggregate signature, as shown in the figure below:

- figure 10: - produce aggregate signature

The expression for threshold signatures is usually written as M /n, that is, assuming that there are n signatures in total, any m signatures are required to generate a valid signature. If the threshold value is 2/3, a valid signature can be generated using any two signatures.

After introducing the threshold signature, even if there is a server 8 out of order, the user can also sign the ideal, but also not increase user inadvertently signed the probability of bad news. In view of hardware, software and operation cannot eliminate the possibility of failure threshold signature is a have the function of the resistance of authentication infrastructure should have.

Although threshold signing provides additional security, it has two major drawbacks. First, the distribution of keys does not prevent long-term attacks: assuming the threshold is 2/3, if one signer backfires, the whole mechanism will leave a permanent hole, and an attacker can achieve the target as long as another signer backwaters. Second, it is possible for an attacker to obtain the key before the key distribution process begins, thus rendering the entire mechanism meaningless. Distributed key generation can solve these two problems at one stroke:

- Figure 11: Distributed key generation -

Distributed key generation is a complex topic. How it works is beyond the scope of this article. However, we will provide a short functional description of how it overcomes the limitations of a simple threshold signature.

Before distributed key generation begins, the user determines a threshold value, such as 2/3. They can select three remote signers and start the build process. The three remote signers generate their own keys, not Shared with the user or any other signer, and some public information through key Manager 9. A synthetic public key can be created by combining public information from the three signers.

- Figure 12: Create the synthetic public key -

Only any two of the three signers are needed to generate a signature, similar to a simple threshold signature.

- Figure 13: A set of signers signs the message -

If there is a signature is not available for use, for example, offline maintenance or attack, you can also through the other two signatures generated the signature.

- figure 14: another group signature signed message -

Can see that the distributed key generation and simple threshold signature has the same advantage, can avoid the risk of the first need to distribute keys. But the fall of a signature device will leave permanent vulnerability problems still exist. The distributed key generation are there any other tips?

Yes, is the "key update". Key update is to destroy the existing key, signed by each generate new key back. New generated key to retain the original key features, that is, any two key can be combined to generate a valid signature. New key has no correlation with the original key, therefore cannot pass the original key to calculate the new key.

- figure 15: key update -

If one signer is attacked, the other signers can trigger the key update. The old and new keys cannot be combined to produce a valid signature. In this way, the key stolen by the attacker will become useless.

- - figure 16: against failure

Key updates can be performed multiple times to prevent multiple signers from being attacked.

Other points to consider

Security is a big concept. Above, this paper expounds the features and advantages of different security layer, and haven't come up with any perfect even the best solution. In terms of protection verifier key, we also need to consider many points, such as:

Hardware wallet

Hardware support BLS12-381 purse line at the meeting is expected to soon. The simple hardware wallet can replace the lower use disk storage systems. But in this way, we may not be able to introduce advanced technology such as distributed key generation.

Cost effective

Any solution that involves security is likely to cost a lot of money to improve it a bit. Each user needs to decide which attacks they want to guard against, and how much they are willing to pay for them.

Store verifier keys remotely

Remote password storage was discussed above. But would there be other advantages (or the opposite) to storing verifier keys remotely? While it does not enhance security, it does give the validator client a faster recovery in the event of a hardware failure, which is of great benefit to the user. However, remote storage carries additional risks because we need to configure the remote storage properly to ensure that only those with permission have access to the key.

Back up the verifier key

Although this paper focuses on how to protect the verifier key from attack, but in fact most of the reasons behind the verification in the event of lost the key to mediocrity. The most common is the hardware store key lost. Users need to have a backup strategy, and they need to know is that once an attacker obtained by backup keys, ta will be able to check out at any news with the public key that corresponds to the signature verification. We should take appropriate measures to ensure that an attacker cannot access has backup authentication key. Ideally, these keys best completely offline storage, and outsiders are not in contact with the storage devices.

Multiple authentication key

If there are multiple authentication keys, between them, or between their respective key withdrawal should have what relation? For example, multiple authentication key backup into a seed, it is more convenient to use, but not bring security benefits. Users should consider whether want to control the key alone at any stage, and plan accordingly.

conclusion

This article provides several ways to protect the verifier keys while ensuring that they can be used to perform the verification duties.

Each user should consider the level of security they want to provide and the steps they should take. It should be taken into account that the verifier key does not control funds, so an attacker who steals the verifier key cannot directly gain any benefits 10.

This paper explores how to protect the verifier key from a purely technical perspective. We should also consider operational and social security needs. All of these aspects need to be considered if the verifier key is to be fully protected.

Alternatively, you can use a pledge service that provides this functionality. With a combination of technology, risk, and money management in mind, Attestant is building hardware, software, and operational services to provide institutional-level pledge services that give you control over your money at any time.

footnotes

1. "ransom, let you have been confiscated otherwise."

2. By "gold finger attack (Goldfinger attack)" or the appropriate scale and the combination of the ETH derivatives, which may indirectly impact on the attacker's wealth.

3. Forfeiture event means that if a verifier causes damage to the ETH 2.0 network, a large part of the pledge will be lost.

4. The range between 1 and 52435875175126190479447740508185965837690552500527637822603658699938581184512.

5. At the time of text submission, the EIP-2335 standard was still in the drafting stage, although it was already being used by a number of ETH 2.0 key generators.

6. We assume that the password is strong enough to be broken by force.

7. This is a good example of how you can combine the two levels to provide greater security.

8. Other threshold signature variants increase redundancy.

9. We use the term to refer to those in addition to the key manager signature to a remote server to perform more operations.

10. It should also be noted that potential attackers are not necessarily aware of this fact.