Keys were generated only in pairs: one types the command, the other presses Enter
When I worked in cryptography, one of the tasks was this: generate keys for a client on a server so that they were guaranteed not to leak anywhere.
There was no magic to it. We simply took the best generally accepted practices and followed them without exception.
It all started with the workstations. Developers’ computers were physically disconnected from the internet. If you needed to send an email or look something up, there was a second computer next to you, for the internet only. Disks were encrypted with TrueCrypt. The key generation server, if I remember correctly, also lived inside an encrypted container: a virtual machine that was started only with a password.
The generation itself went like this:
- Only two people together can log in to the server. The password is split: one person knows the first half, the other the second. Nobody can get in alone.
- On the desk is a printed protocol, step by step: log in, run the command, check the output, log out.
- One person types the command, the other presses Enter. Every action needs both of them.
- Both sign under each step.
- All of it takes about five minutes. The key is generated, only the public part goes out, the session is closed.
There were two pairs, in case someone fell ill or left.
No single person, whether tired, bribed or with an infected laptop, can do anything alone. Every step leaves a signature. And encrypted machines with no internet don’t let anything be carried off over the network.
All of this is standard: dual control and split knowledge, the “four-eyes principle”, network isolation (air gap), and in the banking world, a key ceremony. The DNSSEC root keys and the keys of payment HSMs are generated on the same principle. We showed the protocol to clients openly, and it reassured them rather than scared them.
The Binance hack started with one DevOps engineer’s laptop. In a system where critical machines can’t see the internet and every important action needs two people and two halves of a secret, one person’s laptop is not yet the key to the safe.
What follows from this today is in a separate story.