加密貨幣交易平台之私鑰管理

近幾年加密貨幣與區塊鏈的話題倍受矚目，國內外加密貨幣交易平台亦紛紛設立，但其安全性問題也逐漸浮上檯面，由於現行有許多加密貨幣交易平台是中心化運作，除了扮演了資金託管的角色，甚至也保管了用戶錢包金鑰，因此而造成國內外多起駭客攻擊盜取金鑰之案件，導致用戶的加密貨幣遭移轉而損失慘重。另一方面，因私鑰遺失造成損失的消息也是不時出現在新聞媒體中，故金鑰保管在此領域中是相當重要的議題。本研究將先針對加密貨幣、交易所及交易平台之資訊進行蒐集，並針對金鑰保管之流程進行改良，使用秘密分享(Secret Sharing)方法，設計結合FIDO標準之身分辨識機制，讓用戶能夠使用密碼或FIDO之辨識機制登入或轉帳，避免因密碼遺失而造成損失。此外，本研究透過密碼延伸PBKDF2方法，將用戶密碼複雜化後再用於金鑰加密，可確保交易平台管理者無法取得或使用用戶之金鑰，以強化金鑰保管的隱私性與安全性。研究實作主要開發註冊、登入與密碼變更等功能，實際驗證將金鑰進行秘密分享、加密與還原等流程，皆能如設計運作完成。

關鍵字

加密貨幣交易平台；金鑰管理；秘密分享

並列摘要

In recent years, the topic of cryptocurrency and blockchain has attracted much attention. Domestic and foreign cryptocurrency exchange platforms have been set up, but their security issues have gradually surfaced. There are many cryptocurrency exchange platforms that are centralized, in addition to providing cryptocurrency hosting services, and also keeping the user's wallet private key, thus causing many hackers to attack and steal keys. The user's cryptocurrency was transferred and suffered heavy losses. On the other hand, the message of loss due to the loss of the private key is also frequently found in the news media, so key management is a very important issue. This research will first collect information on cryptocurrencies, exchanges and platforms, then improve the key management process, and use the Secret Sharing method to design an identity identification mechanism that combines the FIDO standard to enable users to use a password or FIDO identification mechanism to login or transfer to avoid loss due to lost password. In addition, this research uses "PBKDF2" method to protect the user's password and then use it for key encryption to ensure that the exchange platform administrator cannot obtain and use the user's private key to enhance the privacy and security of private key management. We successfully completed the secret sharing, encryption and recovery process of the key according to the design, and implemented functions such as registration, login and password change of the system in this research.

並列關鍵字

Cryptocurrency exchange platform ； Key management ； Secret sharing ； FIDO

參考文獻

[1] 北美智權報213期，ICO監管，關鍵得靠業者自律，Retrieved February 16 2019, from: http://www.naipo.com/Portals/1/web_tw/Knowledge_Center/Industry_Economy/IPNC_180613_0703.htm

Google Scholar

[2] 金融監督管理委員會重要公告, 金管會107年重要施政成果及108年工作重點, Retrieved February 16 2019, from: https://www.fsc.gov.tw/ch/home.jsp?id=97&parentpath=0,2&mcustomize=multimessage_view.jsp&dataserno=201901280001&dtable=Bulletin&aplistdn=ou=bulletin,ou=multisite,ou=chinese,ou=ap_root,o=fsc,c=tw