Adam Back makes case for simpler security as Blockstream launches Bitcoin custody system

Adam Back’s Bitcoin infrastructure company Blockstream has launched a new institutional digital asset custody solution developed with French technology group Thales, as the cryptographer pushes for simpler, offline security systems to protect Bitcoin against increasingly sophisticated cyberattacks.

The solution, announced Friday, combines Thales’ hardware security modules (HSMs) with Blockstream’s Secure Multi-Party Computation (Secure-MPC) technology, allowing institutions to authorize transactions while keeping sensitive cryptographic operations within dedicated security hardware, according to the company.

Unlike conventional MPC implementations that may perform portions of the signing process outside dedicated security hardware, Blockstream said its architecture executes the entire signing protocol within the protected environment of Thales’ HSMs.

Blockstream co-founder and CEO Adam Back, a pioneering cryptographer whose Hashcash system helped lay the groundwork for Bitcoin’s proof-of-work mechanism, told Cointelegraph that conventional MPC protocols are often too complex and require too much communication between devices to be practical for fully offline cold storage.

“When people talk about MPC, they’re talking about some very esoteric and complicated protocols that are hard to secure and are very interactive. So you can’t really use them in a cold storage setting,” Back said.

Related: Blockstream rejects ransom as Liquid hackers hold nearly 600 BTC

Adam Back makes the case for simpler Bitcoin custody

Back pointed to the Binance $6.3 billion hack as an example of the risks facing internet-connected custody infrastructure, arguing that keeping signing devices offline can help prevent unauthorized access.

According to Binance’s investigation, attackers compromised employee devices and obtained credentials that allowed them to access the exchange’s wallet-signing infrastructure.

If you connect equipment to the internet, even if it’s via firewalls and so on, there is risk that you can get unauthorized access. You can get hackers into the network, get hackers with access to logins they shouldn’t have and so on.

He also said that AI could make existing security challenges more difficult to manage, particularly by helping attackers discover subtle flaws in complex MPC implementations.