Custody Key Ceremony Design
A custodian is designing key management for a new institutional wallet service holding client assets. The design proposes: a 3-of-5 multisig where three key shards are held by employees in the same office and two by a cloud HSM in one region; shards are generated in a single ceremony attended by three staff; recovery requires any three shards with no additional verification. The threat model includes insider collusion, physical theft, cloud provider outage, and a single employee being coerced. The firm has 40 employees and a modest security budget. Client contracts require demonstrable segregation of duties and auditable key lifecycle events.
1. Identify the weaknesses in this design against the stated threat model.
Read the worked answer
Map each threat to the design:
- Insider collusion: three of five shards sit with employees in one office. Three colluding insiders reach quorum without touching the cloud HSM. Co-location amplifies this.
- Physical theft: shards in one office are exposed to a single physical intrusion; if stored together or in an accessible safe, one event yields quorum.
- Cloud outage: two shards in one region on one provider mean a regional failure removes quorum availability, blocking recovery and operations.
- Coercion: recovery requiring any three shards with no additional verification means a coerced employee plus two others (or coercion of three) yields full control with no delay or secondary check.
- Segregation of duties: a single ceremony with three staff and no independent witness or split-knowledge process weakens auditability; contracts require demonstrable separation.
The core flaw is correlated risk: shards are concentrated by location, provider, and social graph, so the 3-of-5 threshold overstates real resilience.
2. Propose a revised design that fits a modest budget and meets the contractual requirements.
Read the worked answer
Keep 3-of-5 but decorrelate the shards:
- Distribution: spread shards across at least three locations and two providers, with no more than one shard per individual and no two shards in the same physical site. Move at least one shard to a different region and provider to survive a regional outage.
- Storage: hardware security modules or offline hardware wallets for employee-held shards; encrypted backups with separate custody.
- Ceremony: generate shards in a witnessed ceremony with split roles (generator, recorder, witness) and record video or signed attestations. Store no full key at any point.
- Recovery: require a secondary verification step (out-of-band identity check plus a time delay) so coercion does not yield instant control; consider duress codes.
- Auditability: log every key lifecycle event-generation, use, rotation, revocation-with tamper-evident records suitable for client and regulator review.
- Segregation of duties: no single person can initiate and approve a transaction; enforce dual control in the signing workflow.
This meets the contracts at moderate cost by reusing existing HSMs and changing process rather than buying new infrastructure.