Today, we’ll talk about one of crypto’s most essential and fundamental things – private and public keys.
Page Contents
So what are public and private keys?
You can think of a private key as a password consisting of numbers and letters that allows you to access your account. When you first create a wallet (e.g. in Metamask), you get two randomly generated keys:
- A public key which works like a card number or email address – you can safely share it with others to recieve funds, and they will see your address when you send funds to them.
- A private key act as your password or security number – it should not be shared with anyone, as it gives access to your funds. As long as you are the only person who have access to your private key, your funds are safe and you can access and manage them from anywhere in the world with an internet connection and smartphone.
Why private keys are important?
While there are obvious reasons of the importance of private keys – they idetify you as an owner of the crypto address (and the owner of the funds on the account), people tend to miss the actual meaning of this.
Blockchain networks like Bitcoin and Ethereum are decentralised – it is a distributed computers network independent from each other. That means your digital funds are also distributed – there is no bank of centralised authority managing them, on the contrary – you have the sole custody over them with your private keys.
On the other hand, you public keys and transactions are visible to the whole blockchain network as it is an open system where anyone can verify it is working as intended. Even though everything is public and out in the open web, only you private key (generated as a pair to your public key) actually verify the transactions and make them happen.
Why the security of private keys is important?
We already knwo that private keys are what guard your funds against third-party access. But let’s scale it a little and take a look at them from the DeFi (decentralised finance) standpoint. DeFi applications are built using smart contracts (programs with predetermined rules stored on blockchain) which are managed by either individual or grouped (multisignature) public blockchain addresses.
Given what we already know about them, the first and simplest security assessment any crypto company should make before launching their service (and continuously after) – how secure are the private keys to the accounts managing the application or smart contracts. If private keys are compromised and hacker gained access to them, it can lead to millions of dollars being stolen from both the company managing the application and its users.
How to store private keys in a secure way?
There are different types of wallets in the world of decentralised finance, each with their pros and cons:
- Hot wallet (online crypto storage) is the simplest option in terms of accessibility and management of funds. They are called “hot wallets” because private keys are stored online – you simply login to the wallet and gain access to all your funds instantly, with the ability to buy/sell/send and manage funds freely in an instant. We do not recommend having large amounts of funds stored this way as it is less secure – online also means being vulnerable to hacker attacks.
- Cold wallet (offline crypto storage) essentially means keeping private keys stored offline, either on a computer or device not connected to the internet, or written on a piece of paper or just memorised. While it does protect the private keys against theft – and is considered the most secure – it also downgrade the user experience and make interaction with your funds more complicated and time-inefficient.
There are different ways for companies and individuals to guard against possible private keys theft:
- Use different cold wallets to store crypto funds. Hot wallets should be used for day-to-day small transactions, not as whole portfolio storage.
- Use multisignature to enhance security – create a group of accounts guarding the main funds’ vault, accessible only by confirmation from the account group.
- Use risk management tools, like the one offered by Apostro, to keep track of possible vulnerabilities across DeFi applications you use or own. Protocols like Apostro help guard against all kinds of security threats – notifications of malicious activity, bugs or poor codebase, oracle manipulation exploits and more.
