Demystifying Key Ceremonies: Considerations for a Trusted Setup

Transcript

welcome to the fifth CV a virtual series online panel the one about key ceremonies my name is Marcus Paradiso and I'm your host today I had PwC Switzerland's blockchain technology competence center CVA the crypto Valley Association is the leading global cryptocurrency and blockchain technology ecosystem originally founded in souq in 2017 we are now fully global and have more than 7,100 ecosystem members as part of the CVA it is my honor to chair the cybersecurity working group it is

our mission to increase trust in crypto assets in blockchain technology through the development and sharing of crypto cybersecurity best practices we are a core group of a dozen cybersecurity researchers practitioners and auditors and a wider group of about 150 interested members the core group meets monthly to exchange on emerging cyber security threats and techniques and to work on publications and events we aim to have four major publications and events every year in the first 18 months since working group creation we have put

an emphasis on custody and the protection of private keys now we're starting to work on smart contract security and privacy techniques in blockchain heat me up through the website or on LinkedIn if you'd like to join one of our next meetings today we're here to demystify key ceremonies when you unpack you let your nano you check the seal you write down the seat phrase that is a key ceremony when you create the paper wallet using software or dice that you audited before that's also a key ceremony

and when you work through a 100 plus pages step-by-step detailed run book to initialize multiple servers applications and hardware security modules there is also a key ceremony we all know many public blockchains aim to be a trusted system but when handling crypto assets you need a trusted setup to protect the private key that grounds access to your assets this is a whole process starting with the procurement of audited wallet hardware and software it includes creating a backup and it adds when you are ready to transact on the blockchain to make or

receive your first transaction we call these the key ceremony because as one of the common themes it usually includes the generation of blockchain private keys few people have to design key ceremonies for highest security custody the people on the panel today are among the top experts in the field and have tens of years of experience designing executing and auditing crypto key ceremonies we just released their collected best practices today so that you all can benefit from their shared experiences these are the CVA key

ceremony guidelines the link is already live on our website in the news section JP and Maria are the editors of the CVA key ceremony guidelines and I'll be handing over to them shortly but they couldn't have done it alone the entire working group was involved and I'd like to call out one person who cannot be on the panel today this is surely a ping out of Psy's existence Thank You Julian JP OMA song is the leading researcher of cryptographic systems in blockchain and my co-chair in the cyber security working group maria Somerhalder is my colleague in

blockchain audit at PwC and it's the one person in Switzerland who has probably attended the most high security key ceremonies to date JP and Maria the stage is yours hello thank you markers for the nice introduction some here in Malaya from PwC and we're really excited to talk about this document that we've been working on with the CTA cybersecurity walking book so very briefly Mariana will briefly present it but I recommend that you look at it it's very accessible to anyone um so this document will probably be of interest to anyone managing digital assets and therefore

dealing with private keys or C's and of course the more value you manage the more bit code the more eater then the moment you have the more important it is to secure and manage your keys and therefore the more detailed and complex will be your key sir money as Mark will define this for example the case if you are bank equipped or exchange if you're talking millions or hundreds of millions of assets if not more then you want to be very careful how you generate your keys and how you make the backups but perhaps you've never heard about the the what key ceremony and you just wonder what is about so I will let Mary I give you a brief overview of what we're talking about hi guys my name is Maria Somerhalder and

I'm senior associate of PVC and I work for a blockchain competence center um so first and foremost our sis notion that key ceremonies are like a new concept because they are in our industry is associated with crypto which has only been around since 2009 in the current form but they're actually not new the concept has been around for two decades and they're used to secure the integrity of some of the most important and valuable keys for example two backbones internet as well as keys held by governments to secure passports so then what is a key sir me it's actually the name given to the ceremony during which cryptographic secrets are generated in

our context here secrets typically refer to seeds from which addresses and keepers are derived so we are aware that different custody solutions or storage solutions have different kinds of key ceremonies but in general the common denominators are the three following points so the first point is that there are participants that gather together to carry out the steps according to an agreed-upon protocol so during that protocol you generate cryptographic secrets in a secure way in a safe environment so this means that no one before during or after the ceremony can actually guess or know the contents of what happened there so

you can never guess your private keys the second one is that you create a recovery value commonly known as backup and this needs to be any guarantee to work away and where the relevant access controls then the third the third part is that you um you have an auto stability of the whole process meaning that it can demonstrate to your customers and your shareholders that each step was carried out and it was actually secured with this I handle would say JP again thank you Mary Alice good review maybe I won't give you all the content that's in the paper but

maybe we we saw we could focus on maybe the cops three the three most important thing that you have to think about when you do keep ceremony or maybe the top three in internal because most people when they hear about kiss your money what you can probably guess while it's about you can the first consent would be okay I see people in the room matching their hand because I have an ID so the first concern is how do you generate the key from nothing which random generator up to the random generator do you use which is that course important because if you're pure energy is bad then everything is compromising when you have the perfect ceremony but if you prntly if you're to the random kilometer is

compromised or weak or biased then all the rest is completely useless now the good news is that finding a good guarantee is perhaps the simplest problem you have we need you a key ceremony people like to talk about it like to talk about the concept of entropy and so on because that's something that's easy to discuss but from an engineering from a security perspective it's actually the simplest problem maybe the second point that should not be overlooked so I don't know if you a musician you know that practicing repeating again and again and again and again is super important so that's the same when you do it kiss your money it's like if you're playing a piece by the dome on the moon you never repeat enough the more you repeat the

more you learn the nuances subtleties all the details that you miss before you got to to rehearsals dry runs in realistic conditions and that's really how you test your process your technology and maybe last but not least as Maria hinted before what's important is what back herbs more general recovery values because things can go wrong things will go wrong and you need to be prepared so you need to create backups you need to create sales values that can be used when things go wrong so things going wrong might be I don't know some computer dining some storage medium not working some fire in the building maybe some people living the

company or even Watson's so you have to anticipate these cases you have to be prepared and you have to make sure that these recovery values will be available when you need them so then again you need to repeat the process generate the backup values correctly and make sure that they would be walking when you need them and even if you store them for now one two three four five years you want to make sure that five years from now this is available so you know to predict that Earl Exley periodically check that they would walk and it's as every single key ceremony is your son and on but maybe to complete this part I would say everything every minor detail mr. money is ultimately important uh Mariah your turn yeah this leads me to the top three

risks over key ceremony as you were hinting backups are super important so my top one pet peeve or risk that I would like to talk about is unrecoverable black ops because that's literally the worst thing that can happen to you so during a ceremony you have to have a process in place where you create recovery values and you verify them at the same time preferably during the same ceremony so meaning this means that you reconstruct a secret again to test that it works with with the backup process that you have in place and of course any recoverability should be tested before you you move into production anyway but it doesn't actually stop there because after you

have tested your the code your backups you have to decide after the ceremony like how do you save them and wear it like for example the main question that you have to ask yourself is what medium do you use do steel plates to use USB sticks to use people that's one question then you need to decide where you will store them and one of the most important aspects here is that you need to document your chain of custody this means that you need to know who has access to which backups at what time so you know exactly what backups on where and then of course you need to think about things like natural disasters or

hardware failure meaning that you need to have redundant copies of the same backups preferably in G redundant locations so for example if you have an earthquake in burn you will still have a backup in Zurich 150 kilometers from each other meaning that at least one backup is safe but then you also need to go into processes like access controls not only physical but also logical so you need to make sure that you have processes in place to make sure that only certain people have access to the backups and also that you put them in some form of physical protection like you put them in a safe do you put them

in a bank vault those are all things that you need to think about and also I'd recommend companies to make sure that they have some form of access logs so that they know who exactly has as had access to tobacco and then the second second risk I would like to talk about is poor planning of ceremonies because there are many things that can go wrong because many people don't know about the best practices because as we all know this industry is fairly new and there have not been many attempts to standardize what you need to do Jeremy tea-ceremony so one thing that I've seen is that there was poor segregation of

duties so for me as an auditor it would not be acceptable to go into key generation ceremony and do something like enter commands on a computer so you always need to make sure that you have clearly defined your roles of all the participants in the ceremony and make sure that you stick to that so for example an auditor is supposed to be an observing party a neutral party and cannot actually do any active things so you need to be sure of that and you also need to make sure that there's always a for I principle that is being observed meaning that no one person should be should be unattended it should be on a supervise because that could mean that

you can't your ceremony could be compromised another thing is um kind of trivial as well but it's not having variants meaning that you don't have artifacts so artifacts could be a robot a story book a description of the process of the whole key generation ceremony that you can then give to your auditors or give to your clients to make sure that every single step is delineated and that you have a proof that each set was followed and all participants signed off on it so that is one of one of the things that makes it very auditable and it's a very it's a viable tool to make sure that the

trust in your PK is actually warranted so yeah those are the top three Thank You Mario nothing now we will move to the next part of the event which Amy will moderate thanks JP for handing over to Mike and I invite all the wonderful panelists to unmute themselves and also turn on their cameras and it's my my utmost honor to have you all and got a bit more light hug to shed a bit more light on key ceremonies so that's the very first

question it would be great if you answered or if you introduce yourselves first and please say also that how your company and how yourself is involved in key ceremonies and let's go in in alphabetical order so Cheryl please go ahead yeah thank you Amy hi everyone thanks for having me today I'm trans DMA I'm CTO pleasure my background is mostly cryptography and security I spent my whole career in either breaking security solution or improving the security of existing

solution this is the to face of the same coin I think I may leave it in the small card industry and I joined Ledger about three years ago I first created the regional security department which includes the dungeon I am pretty sure you heard about the dungeon this is our internal security research team and also our security state official certification activities and then I moved to the city for those who don't know ledger I don't know if that there is any ledger is a security company I'm sure you know well our Hardware wallet for the client

ledger need us and the journey no accidents this more devices which is the reference in the segment and however it women the best way to sit you and crypto assets for individuals we also have an enterprise solution for managing crypto asset which is called the major vault it's a security product enabling financial institution to manage their crypto assets in the city way it enables our customers to implement their own governance layer within a flexible framework in in order to secure the management of their effects as a secured security company we are involved in

different keys ceremony for instance we do key ceremony internally we are reused for instance attestation mechanism to ensure hardware and software running on our product are legitimate and to do so we generate our own wood keys during internal key ceremonies and it takes place inside the dungeon of course also to use our products our customers are going through ceremonies as Marcus said before for individuals the key ceremony is quite simple you just generate your seed and write down in the paper and it only involve the hotter wallet user

foliage revolt it's a bit more sophisticated since we also want to give our customers a way to avoid the single point of failure and so it's it's made in a distributed distributed way as a security company we're trying to provide our customers with the best tools for secure encrypted assets and this definitely includes the right tools for doing security ceremonies merci JP would you like to go next yes myself before and I myself an expert in crypto cryptography and know if it

before it was cool ten years ago and like Java being interested in writing stuff and breaking watch and quite quite a lot so as a co-founder of tourism also head of head of security and of course we also do the ceremonies of flagship product is called taurus product and something you can see us kind of advanced water system for organizations such as banks don't need to manage money and we of course you have access ceremony because in its its and secrets and other stuff oh by the way kiss everybody is not just about keys that's where the term is not perfect tea ceremony every time you change some critical stuff and yeah so what we do in this context so we assist our customers when it in the key

ceremony because things our products on-premise but we're not the ones think at least for them because you don't have to and we also run cue ceremonies for our own needs so a quite funny mama coming out with this we've learned a lot and I'm excited to talk with all these foreign lenders about about it today thank you very much Maria please go next hi so as I said before my name is Maria Somerhalder and I worked for PwC I got interested in crypto journey University because a friend of mine I was lining it on his laptop in our dorm and then this this became sort of a reoccurring topic

for me because I was working for the Red Cross with refugees and I noticed that some of them were spending like 20% of of the money that they were trying to send home just on handling fees and transaction fees and I thought that maybe Bitcoin might be a viable alternative for them in fact like a later experiences myself while living in Asia and it's going through currency devaluations so that made me decide to actually work in crypto and first I worked for a crypto custody provider in Zurich and now I'm working for POV see ya so what PwC does is it's an audit and accounting company it's not exactly a typical company that

you associate with crypto but yes we are trying to move into that space because you noticed that there is a lack of professional services because we think it's very much sort of wild west industry with a need of professionalization and we have noticed in our last couple of years that a lot of not only big players in the market here in Switzerland but also smaller startups are coming to us for help in order to bring comfort and assurance to their clients as well as their shareholders and we are trying to help them by providing assurance as well as auditing services for them thank you so much and we also have last but not least

partially representing sable hi Vasily Lavrov I'm head of blockchain program management at Seba join the company around two years ago and before that was mainly working as a consultant in the private banking industry in in Zurich I [Music] was actually I why I joined Sabre it was a bit of a fun challenge building a bank in less than 12 months from bottom up was extremely exciting and that's why I decided to join the project I was the first employee in the co area and

together very closely naturally with the CTO the area division we had to basically on a blank piece of paper designed the entire architecture and have sort of a rough idea of what processes or how we would sort of transact with with crypto assets with crypto currencies and that that was one thing I did and in peril of that I was also the project manager for our banking license so working closely also with the regulator yeah very excited to be here what is Sabre maybe in a few words Sarah

is one of the fully first fully licensed switched Swiss fully licensed banks specialized in digital assets so this includes our four divisions which we called as trade trading and credit solutions we have also what we call client and investment solutions we have all naturally everything around custody so digital asset services and last but not least an evolving topic ever in the industry around the asset organization thanks so much my colleagues are reminding me that I

didn't say that you guys can ask questions in the Q&A and you're also you will be able to unmute yourself if you like and ask the question that hey-oh as you move on this next question is going to be for Sharla and also for JP so Sharla asked the CEO of ledger and the creator of Don John and the city of ledger board as well you have experienced a lot of key ceremonies what is the biggest learning and then later for JP as a researcher in security and cyber security mainly and city of ours what is your biggest learning yes with

our product we offer our customers a technical solution for setting the key ceremonies and my biggest learning experience is that unfortunately the users of our products are not all security experts to reference and this is an issue it's difficult to implement good practices when you don't fully understand the ins and outs of tea ceremony so what we learn is the following basically besides the technical solution which must be secured and and of all the requirements we also have to make sure our users fully understand what they are ordering and what are the important points they must pay attention to so

it's about UX it's about education we made sure our UX is as simple as possible while also it contains all the necessary information to understand what is going on on the education side we'll have the technical account managers who are in charge of the training of the users of all users and ceremonies on the revolt are part of the rule onboarding process on the platform and it always comes with the training that would be my biggest learning experience so much to educate on and and this is also why the CBA has published this key ceremony

trusted key ceremony guidelines so this is going to be the same direction or just has the same notion thanks JP good comments by Charlotte and we are slightly different context but while we're getting what I learned I will focus on the the main learning you see if I were to talk about everything we will have liked to our suffer of this mission we have to stuff me but maybe the two men's things I learned so bringing tea ceremony it's learning experience because it's very interesting us let's say a risk management exercise because you combine technology people

process for something that will happen in a very short window of time but with lot of things at stake you know a lot of money and you would have to prepare in terms of threat mother name in terms of what should run you trust and in this context what we've done so you it involves software and hardware and people and stuff so when we use software we value lot transparency or little bility so we tend to use open source software that is establishing trusted and before using it we like to do some review or cert on the cone and everything and test it as much as possible and when meant learning at was what not completely surprise given my background but some established software

that lot of people use that big companies use for collecting at the VidCon and so on sometimes are very fragile or sometimes have birds and the quality is not always there so if you're familiar with the open source community it doesn't come as a big surprise but you know sometimes your purse the face you like and that that's been wasn't expected so we're not extremely careful when we use our party software and we don't use the black boxes we only use stuff real review and yeah that's quite important and the second signa be personally in terms of learning so my background is in technology security crypto and God and I was much less familiar with all the other said

procedural aspects on the Europe receipt box so I don't mean it in a bad way but I've learnt a lot from my colleagues from tourists without a financial background and I've learnt old also from auditing companies that have been working with us helping us improve the majority of our process passing from the quality and roadmap in terms of how we go from this much richer denote that is much richer level and how to structure this in a let's say very rigorous way because we are given the customers we hug and what is the stake we should not make any mistake but like any portions on that not being seen is perfect so you need to have all the processes to react properly and that's been a big learning

for me I'm still learning everyday parties yeah new year is garlic or unexpected things with kiss Irwin is right you can never do this often as you said earlier so the next question will go to Vasily and Vasily you are the one person on the panel who designs many key ceremonies for your company so you're not doing that for an external company but for a saber and my question to you is that which are the main topics you break this process down into and when we prepared for the coin walk me through that have similar things so it would be

nice to you to hear that again and share it with these thank you for the question I think first is I'm very fortunate to work with very smart and very skilled people which helps a lot when you have to design a a custody solution for a bank now there's five areas which I see which some of the other panelists have have talked about but the way we broke it down and Sebu was into these five categories five areas as you mentioned the first one was how do we address physical security that was that was a big big thing during key ceremony how did you make sure that you have only the

people you want there and there's no one sort of looking over your shoulder and trying to memorize memory information sorry that that they they're not supposed to be exposed to physical security first point second part was how do we select the hardware how do we select the appropriate hardware we have two levels of storage solutions hot and I've worked with JP many had many calls with him because it's open to the public that Sabre and tariffs worked together in a partnership for the hot storage solution so too is hardware I would say making sure that you have crystal clear

whether your hardware requirements three it's about which software you're going to be using so what is it a simple computer isn't an HSM sorry is it a software that you develop in-house is it a software that you buy how do you make sure that you install that is the software compatible which with the hardware you're going to be choosing and these three elements are closely tied to the fourth area which is vendor management so how do you set standards to a high sort of how do you make sure that your standards are high enough with the security requirements

that you have how do you make sure that the year after year the vendors where you're working with maintain you know the state of the art solutions so that's a continual review that we're doing and four and five sorry it's around over arching out of those four is areas is sort of the fifth overarching that I call it is how do you design processes and controls which are in line with your bank's risk appetite and which are targeting the state of the art basically solutions which you want to sell to your customers I think that's the biggest

challenge and at Sabre we have a hot storage solution where when a close partnership with Tara so we deployed their solution we designed our key ceremony ourselves without any support from terrace and for cold basically we decided well actually how can we build a solution reducing the vendor dependency because we buy a license from terrace they're super transparent they're you know we can have you know audit reports and so on so forth but we're still dependent on that them as a vendor and for cold storage what we decided to do

is completely develop the solution in-house now because you have different hardware you have also different software for the two solutions you have different processes and you have a different set of physical security and then vendor management because we're using different vendors for the solution so I would say these five areas physical security hardware software the processes and controls and vendor management are sort of the things you need to calibrate depending on the solution you want to build and ultimately the key ceremonies is a mere process which allows you to fulfill that target state is for dad for giving giving us some insight there and

the next question with Maria so you're dealing with various providers with various infrastructures how they make sure that there is some consistency in evaluating these solution providers yeah so I mean it's a bit of a stereotype but for us as auditors it's important to have documentation available so in in the in the topic of key ceremonies this is normally called a run book or a story book so it's basically a process description of the whole key ceremony so it starts with the place and a date as well as the

participants there their full names their signatures as well as a mapping with their roles and then there of course has to be a description of the roles and responsibilities of all of the participants and typically they're divided into four categories the first won't be a master of ceremony who's the leader of of this of the ceremony so this is just a person who is reading the story book out loud to all the participants make sure that they know exactly what they have to do I mean this is a person who signs the so-called deviation protocol when there is anything that is not going according to you to the story book and this is also the person that periodically at

predetermined intervals requests the signatures of all the purchases participants that are in the room in order to prove that each of the follow each of the steps have been followed up until at that point then the second hold out the typically would be there is the operator who is the most active of the participants this would be the person who types commands or connects devices things like that then there will be a witness this is a person who observes and this is typically from the clients as well this is a person who makes sure that no one can see any secrets that they shouldn't be seeing and then the

fourth person to be present is an auditor and the role of the auditor is a bit different than the witness in that they don't actively do anything they're just there to observe in a test but all the steps were followed in the run book then the next thing that is in the room book is an inventory list so you might have a list of harder components as well as as their serial numbers so that at the time of the ceremony you can check if the harder that you actually have in a room is the one that you're supposed to have or if there are deviations the same is done for software but for software and scripts that I use during the ceremony you would have checksums or

certificate numbers which you can also compare and the most important thing is the fact that Rob contains a list of steps to be done so it's it's a very simple explanation divided into chapters of what each person needs to do so it's a it's a chronological sequence of events so it it includes who does what what commands and to be entered and the result that is to be anticipated so with that this is a document that serves the purpose of auditability and auditability again is very important especially for institutional institutional's in this

area because only with an audited document and with a neutral third party like Peter we see you can you can prove that all the steps have happened and you can provide assurance and comfort to your shareholders and clients that yes your assets actually sell it safe so this would be the first go-to document that we use and we of course review it with the client first and make sure that there are no no things that we don't understand from an audit perspective um what else we look at to compare the different kind of key ceremonies is things that I already talked about like are you sure that the for our principle is observed at all time I mean it's

there never a person who can have single control over over the secrets are the backups that are being made and how are they made how it is secured and but then there's also more technical things that you already talked about in the introduction like the pseudo-random generator I mean many people only talk about this and in key generation ceremonies I mean it is of course there should be there should be a good good level of entropy and there should be a good student on a generator to use to generate keys or seeds but it's not the most important aspects but we do look forward or we do look for in in a source of entropy or with pseudo-random generators is that

you can you know two internal logic you know the algorithm and you know the entropy sources you have you have know you have documents to to back this up and even better you have independent code audits there and I'm talking about entropy sources there should be like a a heuristic way to determine the minimal entropy look for example with McLaren or is here I mean you knew 256-bit scalar values and this this is a very good way to do to compare different different key ceremonies but to be honest other other factors are more important for us so for

example we also look at whether or not a company has a data standardization policy meaning that any entropy or any randomness that's used to generate secrets is wiped from any memory after the ceremony so you would normally do this by wiping it several times with random values to make sure that there is nothing left they're coming with a constructed after thanks it is is there more to add or like just would love to take a few questions after you're ready yeah I mean I already talked about the artifacts in the backup so that's fine you can move on perfect just to be

mindful of time everyone maybe let's just take a question now from the audience and excuse my pronunciation but live chat I think JP Lucia please unmute yourself and ask the question and also also respond who for say we want to answer the question so yes can you hear me very well so you French so my question was about the use of the hardware wallet and the recommendation of using either one hardware wallet or several in order to making sure we have the right private

key backup policies so that was my question and who should respond to that Charlie already started prospering so easy.you if you would be so kind yeah I can do it I can take this one I'm the honorary represented representative so there is two different things from one side you have the hottelet on which you can use your crypto assets and on the other side there is the backup program which is which is which is quite different on your hardware is generated

and you will keep it securely inside the secure element in the hardware it but for the backup it's different you you you will want to make it offline and yes backup is definitely a good idea you can also do some kind of of shunya secretary with three different weaker wish it if you want to two out of three or something like this so it's important to have multiple backup but it's not necessary to have two different however to backup your usage it's it's different problems thank you so much hopefully that answers the question and let's take

a one from Marcus Henning as well and then move on to you to the last two questions which I have hey Marcus are you there I'm here yes nice to have you hello where are you from from Germany so much but also lip sync winnable I got one of the guys here please please tell us your question yes I was wondering how the key ceremony has changed if you do use like because I mean I think you mainly spoke about like HSMs but is there any change

if you use like technologies like multi-party computations because I mean there's a thing that we have protocols where you change the key shares and time and so on so it's a big difference or what I use a really really similar kind of ceremony because I just imagined like my shares could be like distributed all over the world on different like like cloud centers and I would have to like say multiply my key ceremony over different regions so it's a complex for me than just having a single device which I have to say backhaul essentially thank you for the question I think JP and also shark and add here we main tank guys so I just typed the ends for any in

the chat and I can kill two birds with one stone by us when for another question that was asked and yet our question was about remote key ceremonies maybe to give some context on my quiz question so Marcos referred to MDC multi-party computation which also includes what is called special signal signature which is a system whereby different participants have different shares of a key different piece of the key but in such a way that they cannot determine the key from the share and in such a way that they can work together or follow certain protocol to create a signature so they will not we construct the key and then sign they will do a graphic protocol to create a signature we have

to keep never being exposed so it's important to give this introduction because it has impact on the type of kitchen monitor that you do so as I enter to Marcos in in the chat there are two main types of key generation the first one is a centralized one while by you have a key ceremony while you generate the master key the signing key and then you generate the shares of the key and distribute the shells and then you make the backup of the key in any way you want the second way is when you use a protocol called distributed key generation so that's the protocol whereby all the possible SWAT together for a certain set of operations control of a protocol to start from nothing to a

state where they all have shares of a key but the key itself is not owned by any party so in this case you will not make a backup of the key because there is no key to backup instead you will make backups of each share of the object and each participant so I've seen cases in some big exchanges where the participants involved for some people with some hardware token people with a mobile phone some cloud HSN from on-premise HSN it turns to be quite complicated but it's it's doing Bob with enough process so in any case there's this process whereby you make sure the generation is sound nobody's cheating

and then come back up somewhere and at the packets will we walk now regarding the question can you do it remotely if you have people in different places in the world and you cannot be in the same in the same physical room so one example and is the trusted trusted set up from Zika for Zika music instruction the progressive personal box and the head remote key ceremony with people all around the world and they shipped sexual laptops different people so I'm tempted to say that in theory it's doable in practice is super complicated especially if you an environment where you are regulated and you need to have all the documentation and you have people like Mark Wilson Mary are making sure that

everything goes well so I'm not sure that Maria will have very much kiss her money on a lot maybe you can answer but it's like opening a can of worms and I would not recommend it and that's all really have to baby Cheryl has something to add here yes with pleasure just I want to repeat the GP just said it I completely agree and just just to comment about that sometimes ASCII materials are distributed people tend to think it's not important to implement the security ceremonies or to use secure City area and from my perspective it's a very big mistake so this is my first comment and the second one is Tresor signature

schemes are quite new cryptographic scheme and from my perspective there's a new protocol didn't pass the test of time yet and in cryptography this is something which is very important it's it's not very responsible to push in prediction such new protocols and GP just mentioned the cache trusted Sita that was a very new article it was pushed in prediction too early and there was a tiny mistake in in this justice souter and and this this mistake could have a very large consequences hopefully it seems not to be the case but still thank you so much for both of you and

now actually the next question is from me - JP NTU Charl and basically if you guys could share how you create you generate the keys to your company's solution that will be very kind who goes first sure JP okay from a technical standpoint the kids generation on volt follows a clearly defined process first of all a quorum of stakeholders is fond typically three people in the organization are selected they will be using the ledger blue the letter blue is a personal security device which and

that's a secure element a secure element is a circuit dedicated to security this secret are used in small towns such as passport and banking cards and inside such a circuit there is random number generator which is implemented descriptive African designs are the most secure way to generate random they are evaluated by third parties and certified by the highest standard I mean Common Criteria I is 31 standard which is the highest level of security for random number generation and along with this hardware and join is implemented cryptographic

post-processing this part is quite simple as said before and this war chain allows to generate high-quality random numbers so just the free stakeholders will will find the secure room and without any cameras smartphone recording device and so on and individually they will generate their shares on their own personal security device each share is then provision to ledger vault HSM using our secure channel the secure channel is a secure way to communicate from the secure element to the HSM and when i say such a way i mean three different

security properties I mean authentication confidentiality and integrity authentication that means that the secure elements which is inside the personal security device is able to prove its identity to the HSN and I mean cryptographically there is an attestation inside gem cave which is installed during the manufacturing of the device inside the premises and vice versa the HSM is also able to prove its genuineness thanks to the ledger with good of trust so this is for authentication when this toxication is established we are able to actually mount the secure

channel and get the confidentiality with an ECG agent and so on confidentiality means that all the data is into an encrypted from the secure element to the HSM and finally the integrity means there is a mechanism to be sure that all the data has been transferred without modification so using this secure channel the three shares generated by three individuals are provisional are provisioned from a personal security device to the ledger vote HSN and the ledger vault HSN will gather them to construct the master secret we use this mechanism with some

variation for several different key generation but always this is the same ID of course during the tea ceremony each individual stakeholder will backup is share using crystal this is something like this where you put your seed inside and descriptive question will be stored in a physical sense so this basically this is what key ceremony looks like on the road thank you so much for familiarizing everyone with with the process and we hand over the mic to JP how do we

generate keys interest we do with the we use a nice very secure dice we run it once twice and it's physical security its fruit to know and on generator secure but laws of physics chaotic systems and so on but of course I'm talking but I mean that that's just a previous to say that the random generator that you use is important and I think what mentioned solved I think it's probably safe I trusted John doing the right thing good security people this is food PRNG certified but I see you also have to be careful of security

of theater this in this side because when when we generate keys we have you know complexity is the enemy of security and I think a lot of person we solve nothing is very hard um so the way we do it like I mentioned before we so software that has been audited trusted used by tons of companies and people we know exactly what's happening from the time when you press the key in terms of hardware software system calls which part of the chip is used we can debug it if need be we can verify everything that happens so I think we the way we use reusing it the most establish cryptographic software that myself being hired to indeed I do my

disorganisation know if I can give the name but it will be no surprise to twenty one and other one not of security is of course we want the name JP okay that's open SSL and the wait for son daughter who would you have all these crypto components you use that in random from a Linux system you use the radar on will see the instructions from the CPU and that's interesting because sometimes when we had customers or partners that we do it this way sometimes they're not disappointed but like but I've seen some company using a crazy you know a big red box with hydro quantum machine learning 1 million bits security and yeah we

don't have this we have something very boring but boring and cryptography often means higher assurance and yeah so if I want to elaborate a bit on this the way we do it well so we generate the key in some on some computer but then you also have the problem of where the computer comes from where does the software come from so we have a process whereby we try to maximize the security assurance in terms of supply chain in terms of software assurance for example your protein system you have the latest version but to have the latest version you need to download it from the internet do you want to download it or not that is kind of question but I think shut off someone has mentioned that

what's important when you generate the keys is that the computer is not connected to any network even to wild wireless networks after you generate it in the keys because to be paranoid in this context we have some processes or some sa mitigations to avoid we'll avoid the exposure of the secret I think like any any likely address for me to understand you generate the key you don't see it you don't see it with your eyes but same time you want to make sure that is safe so we have to use some tools on your wrist extension of the secret keys actually rendom I could talk about the secret sauce you know I'm pretty here

candide about this maybe we don't have so much time unfortunately so thanks for the insights you give and with that just really briefly to Mary and hastily and for everyone on the quality of participants we're going to over run a few minutes hope you can stay on as the panelists can stay on so Maria and Wassily the question is what Maria basically touched based on a bit that which are the most overlooked points during the key ceremony and in which are the most common hiccups and thanks Maria for for for sharing earlier but I was wondering if our silly wants to add there a few points and and if you guys

want to touch base on the single person dependency briefly that would be sure maybe then two things one is I think it's important that you have a clear segregation of duties between the people that did design the key ceremony the people who actually are nominated for the actual execution of the key ceremony and at the end the people who will be operating on a day to day the solution which was initialized during the key ceremony so I think that's what we decided that ceiba very early that we have this three line segregation in my experience the most overlooked item is a

appreciation of how much work goes into doing a key ceremony or preparing a key ceremony but more seriously I think it's about making sure you repeat time after time as much as possible sort of in your dev or testing environment the protocol with the scripts you're using very often it can happen that actually last-minute changes you change basically your your run booked your protocol and it's not matching actually what has been implemented in the script and so there has to be like an intervention protocol

where people start asking questions or simply the key ceremony is then aborted you go back to your desk and you start then fixing things before you execute the entire process all over again it's so much we will just skip now to single dependency question in and with that we reach the last question which is basically a quick question to everyone and if you can give one recommendation for institutions who are just planning their key ceremony then what is that one key recommendation you you would give I

really want to start now the most important thing would be to think in advance about what you actually want and they're very clear concept of what key generations army entails so who would have to be there what hardware do we need what what software you going to use the issue that was touched upon as well like do you want a largest for the most updated version or are you going to go with the relatively secure scalable build and have a concept for access management backup they'll be my recommendations thank you so much charlie yeah recommendation from from my

perspective which is Parliament for tea ceremonies people raishin you have to keep in mind the war picture of the security program you will try to solve in particular you have to make sure that your kiss ceremony is actually compatible with your threat model this is an overall analysis which must be conducted from an operational standpoint you have to design a backup strategy make sure to avoid any single point of radio you have to answer to the following question what happens if one of my stakeholders turns mode what happens if one of mystically threatened or taken a job and so on and for a technical standpoint I always recommend

external situated it this is power power once you have an expert eye you have to make sure the components you use software and hardware are correctly implemented and take into account supply chain attack threats and finally a very practical advice avoid on every single step of your kiss ceremony from the generation provisioning black cap recovery and before the d-day practice again in the game that would be my main recommendation thank you so much JP you want to go next well everything that sounds just said there's maybe one point you also have let me mention it

but you have to know that you also have to do key ceremonies or ceremonies with a similar process when you do other critical operations such as maybe doing it from where updating your HSN or changing critical parameters in your secure element so you may have to do a kiss or money even if not key is generated so you have to identify what you need to do it to do this thank you very much Wesley what are your thoughts here I mean I agree with what all three previous panelists said I would just add try to keep it simple and secure it's the kis s really the kiss I mean

for us times were too ambitious we wanted to over complicate things and we realized that actually perhaps by making so secure you're actually or by trying to make it so secure you make the process is so complex that you end up jeopardizing security and so keep it simple and secure thank you so much for each of you Maria Sheryl JP Vassili pleasure to have you and and to shed a bit of light on the key ceremonies and we could chat

about this for hours but this much time we had and with that I will pass back to Marcus thank you Amy and everybody for sharing the wealth of your experiences with key ceremonies and helping everybody become better at securely generating their private keys coming back to Amy's question just before my one recommendation is don't do a rookie mistake don't share you privately ever and don't use we can throw P because if you search for this it's been cracked already it's been brute forced now I hope that the key ceremony guidelines and this panel helped you and

will help you all of you in the audience to increase trust in crypto assets and blockchain technology because this is a permission in the CVA cybersecurity working group to increase trust include two assets a blockchain technology through the development and sharing of crypto cybersecurity best practices unfortunately we're at the end of our time if you have any questions left don't hesitate to contact us through the CVA website twitter or linkedin we'll also be posting the link to the CVA key generation guidelines in chat and we'll be sending it around finally please do get in touch if you'd

like to become a member of other working group you're going to be the first to hear about upcoming threats new standards and publications and will be able to participate in publications and panels like these my name is mark Esparza I chaired a CVA cybersecurity working group together with JP oh my soul and we hope to hear back from you with your key ceremony war stories and crypto cybersecurity best practices thank you goodbye everyone everyone thank you thanks guys thank you do see you thank you bye