Key Management 101

The first post of this series pointed out that key management is a big challenge for any blockchain-based app. Users often lose their keys, and account recovery tends to be a difficult — if not impossible — process. To build a better key management system, we first need to understand current approaches. In this post, we'll take a look at how keys work, at typical key management strategies, and at how those strategies limit account recovery solutions.

At its core, owning a Stellar account means possessing a key for that account. That key is made up of two parts: the public key, which you share with others, and the secret key, which you keep to yourself. This is what a public key looks like on the Stellar network:

It starts with a G, and serves as the account address: people send funds to it, and those funds show up in your balance.

This is what the secret key looks like. It starts with an S:

On the Stellar network, the secret key that defines your account address is called the master key. By default, when you create a new account on the network, the master key is the sole signer on that account: it's the only key that can authorize transactions. Being a signer on a Stellar account is sort of like being a signer on a bank account: you can sign checks, and the bank will accept them as valid.

However, you can also add signers to a Stellar account in addition to — or instead of — the master key.

Once you've added signers to an account, you can configure it to let signers authorize transactions individually or together. On Stellar, the configuration of signers required to authorize transactions is controlled by setting a threshold on the account and weights for each signer.

If an account has a threshold of 20 and signers of weight 10, at least two signers need to sign a transaction for it to be valid. If an account has a threshold of 1 and signers of weight 1, any signer can sign a transaction. The term multi-sig is frequently used to refer to accounts that use multiple signers, and SEP-30 — which is the key management solution we'll cover in the next post — leverages Stellar's built-in multi-sig capabilities to offer a new method for user-friendly key management.

However, most accounts on the network only use the master key, which means they only have one signer. While some wallets add an additional signer for 2FA, control of the account still tends to hinge on possession of the master key, and so right now, when wallets come up with key management solutions, preventing master key loss is typically their sole concern.

Most wallets store an account's master key on a user's device, and then rely on a couple of strategies to prevent the user from losing access to their account.

Often, they ask the user to write down or print out their key, and to rely on the paper backup if they lose their device. This is simple and straightforward to implement, but it presents some real challenges:

1. It puts a lot of responsibility on the user.
2. The user needs to write down the key correctly.
3. If the user loses the piece of paper, they lose their backup.
4. If someone else finds the paper, the user’s account is easily stolen.
5. It can be a jarring experience to ask a user to write down a lot of text immediately after installing a new app.

Instead of relying on paper keys, some wallets store a copy of the master key on their server. For that to work, the user has to trust the wallet server completely because the server has access to the key — and therefore control over the account. In some cases, a wallet encrypts the key with a user-generated password that's never shared with the wallet server, and since the wallet can't decrypt the key, the wallet server doesn't have access to the user's account. However, since the wallet can't decrypt the key, the wallet also can't help users who forget their password, and losing keys and losing passwords often go hand in hand.

Beyond that, there isn't much a wallet that relies on the master key can do to help with account recovery, and those approaches haven't proven to be all that user-friendly. There may, however, be a better approach.

To find out more, check out the next post in the series detailing SEP-30, and explaining how the Vibrant app uses it today to improve key management and account recovery.