Bitcoin and Cryptocurrency Technologies

Figure 4.3: A Bitcoin paper wallet ​with the public key encoded both as a 2D barcode and in base 58
notation. ​Observe that the private key is behind a tamper-evident seal.
Tamper-resistant device.​The fourth way that we can store offline information is to put it in some
kind of tamper-resistant device. Either we put the key into the device or the device generates the key;
either way, the device is designed so that there's no way it will output or divulge the key. The device
instead signs statements with the key, and does so when we, say, press a button or give it some kind
of password. One advantage is that if the device is lost or stolen we'll know it, and the only way the
key can be stolen is if the device is stolen. This is different from storing your key on a laptop.
In general, people might use a combination of four of these methods in order to secure their keys. For
hot storage, and especially for hot storage holding large amounts of bitcoins, people are willing to
work pretty hard and come up with novel security schemes in order to protect them, and we'll talk a
little bit about one of those more advanced schemes in the next section.
4.3 Splitting and Sharing Keys
Up to now we've looked at different ways of storing and managing the secret keys that control
bitcoins, but we've always put a key in a single place — whether locked in a safe, or in software, or on
paper. This leaves us with a single point of failure. If something goes wrong with that single storage
place then we're in trouble. We could create and store backups of the key material, but while this
decreases the risk of the key getting lost or corrupted (availability), it ​increases​the risk of theft
(security). This trade-off seems fundamental. Can we take a piece of data and store it in such a way
that availability and security increase at the same time? Remarkably, the answer is yes, and it is once
again a trick that uses cryptography, called ​secret sharing​.
Here’s the idea: we want to divide our secret key into some number N of pieces. We want to do it in
such a way that if we're given any K of those pieces then we'll be able to reconstruct the original
secret, but if we're given fewer than K pieces then we won't be able to learn anything about the
original secret.
108