The key ceremony

Graduate · enrolled learners

This lesson opens with Profanity vanity addresses and Wintermute, September 2022.

What happened

Profanity was a popular tool for generating Ethereum vanity addresses, ones with a chosen prefix or suffix. To find a matching address quickly it seeded its private-key search with only about 32 bits of randomness rather than the full key space, which made the resulting private keys computationally recoverable by anyone willing to grind through that small space. In September 2022 the market maker Wintermute lost about 160 million dollars when an attacker recovered the key to an administrative account whose address had been generated with Profanity, and other holders of Profanity-generated addresses were drained too. Nothing was phished and no server was breached; the key was weak from the instant it was created, because the randomness that made it was too small. A private key is only as strong as the entropy that generated it, and Profanity fixed that weakness permanently at generation time.

The decision point

A key's security is decided at the moment it is generated and cannot be improved afterward: if the randomness behind it was small, the key is guessable forever, no matter how carefully it is stored. That is why an institution generates keys in a ceremony, a deliberate, controlled event whose entire purpose is to guarantee the properties that cannot be added later. The ceremony ensures the entropy is real and large, so no one can grind the key out of a small space; it runs in an isolated environment, so the fresh key is never exposed to a networked or compromised machine; and it follows a recorded, witnessed procedure, so the institution can show how the key was made and that no copy leaked. Profanity is the ceremony's opposite: a key generated for convenience with entropy small enough to break. The lesson is that storage discipline cannot save a key that was born weak, so the strongest control an institution has over a key is the care taken in the minute it is created.

Recorded loss

$160,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.