Filecoin Filecoin Storage Provider Bootcamp, by ESPA, 2 Mar 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: ESPA Module 3E - Wallet Set-up

Description

Alex Fox (Architecture Lead) with PiKNiK discusses wallet set-up at the Enterprise Storage Provider Accelerator (ESPA) bootcamp week that took place in February 2022. This discussion includes multi-signatory, hardware vs. software wallets, protecting FIL with tools and processes.

Data is growing at an incredible speed and much of this data is archived and/or simply lost by enterprises. Our program will accelerate net-new Enterprise Storage Providers into the ecosystem, using a Web3 protocol with an impressive incentive model called Filecoin.

Learn more at:
Sign-up: https://web3espa.io
Landing Page: https://m.fil.org/espa-bootcamp

Follow ESPA:
Twitter: https://twitter.com/web3ESPA
LinkedIn: https://www.linkedin.com/company/web3espa/

A

Well, it's set up what is a wallet. Well, a wallet is a flat case or pouch that can be used to carry small personal items like paper, currency, credit cards, identification documents and other paper or laminated cards.

A

Questions alright, there's more. uh What is a file coin, while it's okay? uh Well, just as a traditional wallet, holds your currency, usually in form of cash or cards. A falcon wallet holds your digital currency, fill in the form of a secret key. For all intents and purposes, the secret key is the money contained in the wallet.

A

A traditional wallet controls the access to your currency. In a way we don't just give people the entire wallet. We authorize those transactions by opening our wallets and taking out the cash we want to give someone else. We don't give them the whole wallet same with the falcon wallets. We don't give people that secret key. We use the wallet to perform the transactions that we actually want to perform with the amount of fill that we want to transact with.

A

We use the secret key to store and access the fill securely and we don't reveal that key to anyone else.

A

The two main forms of wallets that we use are hardware wallets and software wallets. They each have pros and cons, but they both give us the ability to store and access fill.

A

The hardware wallets is a physical device that stores the secret key. The secret key is never revealed outside of that physical device. It's considered the most secure way to store the film, because it keeps the secret key, essentially offline, where no one can access it.

A

The only way to access the key is to physically have that device and to know the passphrase on the device. Even then, we're not directly accessing the key we're just using it through the device, it doesn't give us direct access to it, there's no way to get it out of the device. The key is actually stored on tamper-proof silicon in the device.

A

If we try and retrieve it, it should be destroyed. It's just in there with that level of security, it's less convenient to use the wallet, because uh we have to connect that hardware wallet to a machine and enter that passphrase on the device, usually little buttons to press and bring it online briefly by plugging it in every time we want to send that transaction. We can't just leave it on a server. That's automatically doing it.

A

We have to manually approve each transaction, but then that becomes a good option when we want to store large amounts of fill when we don't have to send those transactions out often, but we want it to be secure, you can still receive that fill even when the wallet's offline it doesn't have to be plugged in because the actual, sending and receiving a fill happens on the blockchain.

A

So when the wallet's not plugged in people can still send this fill next time, we plug it in we'll see yep, it's it's arrived there and we can see without even plugging it in we can see it's on the blockchain arrive to our address. All those transactions stay on the blockchain. The only hardware wallet that supports fill currently is made by ledger and it doesn't. Support fell out of the box, but when we use a software tool like glyph or lotus wallet, we can use the ledger to uh interact with our far coin wallets.

A

The other option, if you want to store fill, is to use a software wallet, they can come in various forms and they could be an online exchange. It could be software, we ran ourselves or a third-party apple website, so an exchange is a third-party site. We have to trust them with the keys to the wallet but there's other online, while it's available in the case of using the lotus software itself, the secret key is stored on the server that the lotus install is running on.

A

That's, what's used to send the transactions it's more convenient, but to secure that, while it's as it's it's not held in a tamper-proof piece of hardware, we need to use more layers of security to make sure no one gets access to that server because they can potentially access that key when we're accessing.

A

While it's on third-party websites, we need to trust those websites and ways to trust the exchanges we use, because they could do something bad with with our wallets they're in the hands of someone else. If we want to be really secure, we just have them on our own software.

A

If we do lose the secret key, we could lose all of the assets in the wallet it's equivalent to just handing someone your whole wallet. They can just take your money, so you don't do that. You make sure that it's not exposed to anyone.

A

um You need a plan in place to make sure it's secure when you're using the hardware software wallets so be careful of who can physically access the building the data's in the data sensor you're using the home. If you have backups there, maybe ledger devices uh generally they're pretty secure, but you never know there could be a problem if, if we don't know about that develops, if someone's actually physically able to access one, so we should just generally make sure that that doesn't happen.

A

There could be a potential attack vector and have monitoring in place, maybe cameras or um some kind of access monitoring on both on the online and offline to see who's coming in out of those areas who logs in make sure your network is secure, especially if it's connected to the internet, so use firewalls, maybe even go as far as using zero trust.

A

Architectures next generation, firewalls, whatever is most appropriate for your needs, keep the servers on machines using up to date with software updates to just make sure you protect against the latest vulnerabilities, that's uh general good practice and backup the keys somewhere secure, but make sure that's not introducing a vulnerability by being an easy way for someone to steal the keys.

A

Typically, the wallet's made up of two separate parts: there's the private key, which is the secret key, that we've talked about.

A

That's what's actually used by the software to make transactions and access the wallet take money out, send it somewhere else. It all needs the private key proves. We have ownership of the wallet as such. That's what we need to secure, but we also need a way to accept fill into that wallet.

A

We don't give them the private key, because then they could do anything we can so we need a way to accept phil into the wallet where I'm giving the private the private key, because if they have the private key, they could do anything we can. They could take money out of our wallets there's a corresponding public key associated with every private key, and we use the public key to let other people send fill to us.

A

The public key is derived from the private key, so it's a one-way function. Each private key has one public key. It's difficult to derive the private key from the public key, well, very difficult, essentially impossible.

A

It's it's as impossible, as anything in cryptography is at the moment maybe there's a quantum computer coming up. That can do it, but if that does happen, then the farco network will be upgraded accordingly. So it's essentially not a concern. We can just consider it impossible to create the private key, knowing a public key.

A

That means no one can do anything they shouldn't do just with the public keys.

A

We can give other people the public key to send phil to us from their wallets into our wallets, and you don't need the the private key to be online to receive fill because it just happens on the blockchain. People just need to know the public address.

A

Then they can send. You fill.

A

There's a couple of different ways to interact with the farcoid network and manage the film first is the deloitte's wallet. So loads has been software. It's a reference implementation of the falcon network, it's written by protocol labs.

A

It's it's a command line, interface, it's functional, but basic. It lets us do everything we need to do, though uh interactive focus network, it does work with. Well, it implements a software wallet. It works with hardware, while it's it contains a lot more functionality than that.

A

But for what purpose is that we can just use that as our wallet, we can also use lotus to set up the loads node, which synchronizes with the rest of the network and the storage provider node, which allows us to seal data, store data compliance, but we could use an external wallet but be careful when using an external wallet, because external means one not run by the actual storage provider so run by a third party.

A

They have full access to anything. You can do with your wallet, so you need to make sure they have done appropriate security audits that they're reputable two examples with secure audio or it's having been performed on them. But there's more examples. So glyph it's a browser-based tool. You can interact with the ledger hardware, wallets to sign or send transactions and fox wallets.

A

It's a mobile app on android or apple devices that we can use to interact with the falcon network and send or receive transactions. They've been independently audited and others are available, but any vulnerabilities in those would be a problem.

A

Then cryptocurrency exchanges, most people these days are probably familiar with just the general concepts of a crypto exchange, no convenient we can buy phil exchange it from other currencies from fiat currency and store fill usually makes it easy to access the fill as well, but just be careful about leaving significant amounts of assets on those exchanges, because there have been a number of high-profile incidents with currents being stolen from the exchanges. It's just it's not it's not in your hands. If it's on an exchange, it's on someone else's hardware. Something could happen.

A

It's a useful tool, but for the best security use your own, while it's store locally hardware, wallet or lotus wallet, because then you're in full control of the security. It's not up to a third party, but maybe it makes sense, it depends, depends on the amount of fill you're looking to protect.

A

So in practice, you'll use a variety of different wallets, depending on the need not just one.

A

If we're looking for a more secure way of protecting what a wallet can do, we can use what are called multisig wallets so called because there's multiple signers multiple signatures required to authorize any transaction different people. Different entities can be given different private keys and it's only possible to perform transactions with a correct number of those keys, meaning one person isn't just able to go rogue and take all the money at the while it requires multiple people to authorize anything.

A

It's useful when, when it's difficult to ensure full trust between all the parties involved, because when we're using one single wallet with one key, then who gets the private key? How can we make sure that no one just takes that takes that money and walks away?

A

We can use multisig wallet, make sure no one person has that authority. It resolves the trust. Each party involved in the multisig wallet has their own key. They control their own key and each person is called a signer it'll take two or more signers to send the transaction from the wallet.

A

When we create the wallet, we can specify the list of signers. We can have as many people as we need to be involved there, and then we specify how many of those are required to send a transaction to the network so to be able to spend the film in the wallets. Essentially it could be two people it could be.

A

All of the people can't be changed after creating the wallet, but we could just create a new wallet if we wanted to change who's allowed to do what, in practice, the workflow for sending a transaction from a multisig wallet is that any signer can propose that transaction goes into mempool uh waits on the network. Everyone else can the different scientists can see that, but they then they can then approve the transaction as well.

A

If they choose to that happens, each person approves it until the minimum number of signers is reached, and then the transaction is completed goes onto the network. The fill gets sent to where it should go, so it allows uh trust to be split out from the uh from that single wallet.

A

If too many signers do lose access to their keys, then it would render well inaccessible if one person has a key, but you need two people to sign a transaction. Then if one person has a key and everyone else has lost their key, then that's essentially just it's lost all the funds in the wallet, so you've got to make sure that there are enough people with access to the keys and they don't lose. It.

A

Lotus is software built and maintained by protocol labs. It's a reference implementation of the falcon network. It contains the features to run a loader's node, letting us interact with the network, also run a storage provider node and run a wallet to manage phil and the accounts and more it's the reference implementation. All the latest features on falcon network appear in lotus.

A

There's two running versions of the network. We can join, there's mainnet, which is the real version of the network. If we create wallets on mainnet and spend phil on mainnet, it's real money and if we're doing testing, we may not want to use that.

A

So for that purpose, there's a separate network called calebnet and it's a test network. We can spend essentially play money on the network. We can test things out and send phil around and it's just test money. It doesn't have any significant value. We don't have to worry about it. The main net network addresses get prefixed by f for far coin and t is on the test net, which calculates I mean it's. It's called calib net, but it's prefixed with t for testing.

A

That's just how it's arranged.

A

There's different kinds of addresses that you'll see on falcon network, so, let's just go over each one of those briefly first address you'll see is prefix by f0, it's the it's an identity address, it's meant to be more human readable, because it's a lot shorter than other forms of addresses.

A

One example fo three, three, two, five, nine! You know you could you could read that back to someone um each of the shorter addresses is tied to a longer public address behind the scenes, but we only we see the shorter address. We can just use it as the full address and they're linked to individual storage providers.

A

Next address is the f1 type of address. It uses the secp 256k one signature and cryptography not too important to understand what it is, but that's what it uses. It's able to validate messages from other blockchains that use the same signature such as bitcoin. You can derive the public key from the signature, which means that the blockchain doesn't have to store that public key when you make transactions, and that saves space that translates to lower fees. So it's a good idea to use an f1 address.

A

If you don't need anything else.

A

If you do need something else, you might be interested in the f3 address. It uses the bls signature instead, there's benefits to using this address. It's deterministic for a given message and key. The signature is the same. It increases security against common blockchain vulnerabilities.

A

You can aggregate multiple signatures from sinus into a single signature which saves space on the blockchain with the condensed signature, but it does consume more space on the chain when you're using it for things it doesn't really need to be used for you can see in the example of that f3 address it's quite long, so it just takes up more space in messages and associated fees are higher, but it's necessary to be used in, for instance, the storage provider's work address, that's dealing with storing data.

A

It needs to be an f3 address for that for the features it provides. Then there's the f2 address for actors on the far core network. Those are specifically defined in the falcon spec. It defines types of actors like a storage provider appliances, different actors, they're, essentially smart contracts, as would be understood on other blockchains. They have certain abilities that they're controlled by the blockchain.

A

No one has a private key for them. They just live on the blockchain and they perform actions that are predetermined, such as the multisig wallet as well, because it's not controlled by one single person. It's an f2 address. It has multiple signers, it's a essentially a smart contract.

A

It just lives on the blockchain.

A

Then the different roles of wallets, the first and most important specific wallet with a role is called the owner wallet the owner address it's while it controls the storage provider node. It has a lot of power over storage, where I denote any balances on the storage provider node that we withdraw go into the owner wallet.

A

You need access to your owner wallet in order to change to a new owner wallet, and you want to protect it because it has full control over the storage provider. You should isolate it from the rest of the network. Limit access to who can use it have backups keep those backups secure, maybe keep the private key on a hardware wallet, because it's got full control of the entire store provider.

A

uh This time, unfortunately, the wallet can't be stored in a hardware wallet or a multi-sig wallet, which is really what we'd like to do for security. The most secure, not the most vulnerable key. It can't be secured on hardware, but it's that's again. It's enough for features being worked on. uh You can see issues on lotus's github um to see progress. It's all public, and certainly a lot of people are interested in getting that functionality.

A

The next wallet is the worker wallet for day-to-day tasks from the point of view of storage provider. So it sends messages to say we have proofs available terminating sectors, the process by which we prematurely discontinue running a sector. We can signal this network, we've lost a second, for instance. Somehow we can tell the network okay, we need to terminate our sector because we, we don't have it anymore, we'll incur a lower fee.

A

That way, then, if we just don't tell the network that we've lost data we try not to, but if we do well, that's uh that wallet would send that message and if we make a deal client makes a deal.

A

Then we as a storage provider that while it would send a publish storage, deals message all the funds for those transactions come from the worker wallet when the storage provider needs fill for those kinds of messages or for the pledge collateral put up when you're sealing data it'll take it from this worker wallet. Unless there are specific speciality wallets that are dedicated certain purposes which we can talk about.

A

Next, we can split out those responsibilities from the worker wallet because of the head-of-line blocking problem inherent in the queue system used on the messages on the network. It's impacted by congestion.

A

Many types of messages sent to the blockchain some are more time sensitive. When we're sending proofs of successful ceiling of data.

A

Well, we have to send that proof in a certain period of time, but when we send other messages, there's no time limit, so we may want to spend more on the gas fees for the more important messages, but when we're sending messages from a wallet they're processed in order, if the important message gets stuck behind a message, that's not as important it can delay that important messages from getting through. So we would then look at using separate wallets that have their own dedicated purpose to make sure nothing important gets delayed.

A

It can have its own separate wallet and really you can just think of it as lanes on the highway. Separate lanes, send the messages down their own lanes. If there's a car stuck in one lane. Well, okay, no one! No one's moving over in the in the fall coin uh analogy here: everyone will just stay in their lane and just wait until it goes away. uh You open up the separate lane, so you can send the fast messages down that speedy lane.

A

So more about congestion, the falcon network can get busy when there's a lot of transactions occurring. The same way we experience rush hour on the way home from work messages can get delayed during busy times.

A

Normally it's not that big a deal but there's one specific messages: that's really time sensitive for the storage provider to send, and it's the daily audit message called window post window proof of space time. We've got to send that within within 40 minutes every day from for each piece of data, and it's got a lower cost. But if you get stuck behind other messages in in a worker wallet, then it gets blocked and if it takes too long, we would then have penalties incurred that we didn't really need to.

A

So we create these separate lanes to avoid that congestion. The solution these separate lanes are called control. Wallets.

A

You can see on the slide an example of the control wallet to send your proof of space-time messages down in in that speedy, looking car. uh Well, the other boring mundane messages can just they can wait, because it's no big deal if they're delayed, we need the. We need the post message to go quickly. We use control wallets, we split out into as many wallets as required, depending it depends on the storage provider's needs.

A

Generally, though, we're looking at proof of space-time wallet, pre-commit message, while they're part of the ceiling process, commit wallet again part of the sealing process, but maybe there's different fees attached to that. So you may want a different wallet to have different requirements, publish message for uh client transactions. If you want to make sure they get on chain quickly. You may want a separate, wallets and terminate wireless. If you're signaling to the chain that you have lost data, you can send it separately that way because it's it may be important. You do that quickly.

A

So, as we can tell there's a lot of different considerations to make when restoring and managing the fill a lot of different ways to do it, each way has its own benefits and its own drawbacks, but generally the communities found that best solutions include a variety of different wallets, taking advantage of the strengths and weaknesses of each one depending on the use case.

A

But we must always remember that security is the most important takeaway here. If anyone gets the private keys, they have access to the funds. We have to protect those private keys, it's the worst case scenario and we must do everything we can to prevent it. That being said, it's perfectly secure to use the network just have to keep that in mind, just as we wouldn't just go and give someone our wallet in real life.

A