Yes, standard is using a key management system (KMS), but there's a lot of nuance and complexity there. Depending on the threat model, you can use software systems, hardware systems, multiparty crypto systems, and you need to think through all kinds of failure modes very carefully (particularly around disaster recovery or insider attack scenarios.) A good place to start is cloud-based key management systems, because they take care of a lot of the complexity, but you still have to do it carefully (e.g., paper backups in a multiple safes, protecting the cloud resources correctly, 2FA on your account, etc.)
Protecting high-value cryptocurrencies is particularly hard, and as much as crypto people like to say "not your keys, not your coins", the reality is far more nuanced, and the average person is much better off using a well-known platform like Coinbase. Even hardware wallets are not as simple as people thing to use safely.
(If you're building cryptocurrency apps, never upload wallet private keys to cloud KMSs. Instead, generate wallet keys using the KMS itself, and use those wallets for small "in-transit" funds only. Think of them like bank branches, when you manually transfer small amounts of funds securely from a set of central wallets.)
Comments
Yes, standard is using a key management system (KMS), but there's a lot of nuance and complexity there. Depending on the threat model, you can use software systems, hardware systems, multiparty crypto systems, and you need to think through all kinds of failure modes very carefully (particularly around disaster recovery or insider attack scenarios.) A good place to start is cloud-based key management systems, because they take care of a lot of the complexity, but you still have to do it carefully (e.g., paper backups in a multiple safes, protecting the cloud resources correctly, 2FA on your account, etc.)
Protecting high-value cryptocurrencies is particularly hard, and as much as crypto people like to say "not your keys, not your coins", the reality is far more nuanced, and the average person is much better off using a well-known platform like Coinbase. Even hardware wallets are not as simple as people thing to use safely.
(If you're building cryptocurrency apps, never upload wallet private keys to cloud KMSs. Instead, generate wallet keys using the KMS itself, and use those wallets for small "in-transit" funds only. Think of them like bank branches, when you manually transfer small amounts of funds securely from a set of central wallets.)