Imagine a cold, freezing vault deep underground in the Swiss mountains, with icicles decorating the thick steel door. That’s cold storage.
But “cold storage” in the bitcoin world (and in the tech world in general) is a bit more accessible. It implies the storage of data (in the case of bitcoin, of your private keys) completely offline. It could just be a pendrive or even a printout of the key (yes, on old-fashioned paper), shut in a drawer. Or, if you have a lot of bitcoin, locked away in a vault.
The important characteristic of cold storage is that it is not connected to the internet. This makes it especially secure, as there is virtually no way in for hackers or viruses. So, cold storage is used to “park” large amounts of bitcoin in a more secure manner.
Why “more secure”, rather than “totally secure”? If your storage device is damaged by water or fire and your keys are not retrievable, nor are your bitcoins. For “totally secure”, you’d probably have to resort to the aforementioned freezing vault in the Swiss mountains. But the idea does highlight the (relative) vulnerability of anything stored online. Many bitcoin holders keep most of their bitcoin in cold storage, and the minimum necessary for transactions in their online, desktop or mobile wallet.
But, I hear you ask, to move bitcoin to and from the cold storage address, to spend and to receive, surely you have to connect online?
To move bitcoin to the cold address, no. A cold address can receive bitcoins without connecting, since the bitcoins are stored on the blockchain, not the device. The device only stores the keys. The bitcoins sit on the blockchain, but are associated with those keys. You can check on your balance at any time by entering your public address into the search bars in either blockexplorer.com, or blockchain.info.
To send those bitcoins to another address, either for a purchase or a transfer, you do need to input the keys online. This is either done manually (typing in the keys, or scanning the QR codes with your phone camera or your computer webcam), or by temporarily connecting the device (switching it on and connecting via wifi, or plugging it in to your computer).
A problem arises when you want to use a different cold storage address each time you send coins there, for privacy reasons (re-using addresses is not a very secure practice). If the “cold” side is not connected, how can the “hot” (= online) side know the addresses that it needs to send the coins to? One solution would be for the cold side to connect every now and then to send a bunch of addresses over to the hot side. But that would reduce the cold storage’s security (each connection opens up a vulnerability).
Another, more secure, solution lies with the hierarchical deterministic wallets that we looked at last week. Both the hot and the cold side work with the same root, or “seed”, which is usually a long string of words. The hot side generates the addresses using one algorithm, while the cold side generates the corresponding private keys using an offline “sister” algorithm. If the hot side is compromised, the private keys are still safe, as are the associated bitcoins.
The physical wallet
When we talk about cold storage, what does it actually look like? What are the “cold storage devices” that we mentioned earlier?
They can be anything that can store data. A pendrive, a laptop, a tablet, a piece of paper, a mobile phone… Or, a dedicated cold storage wallet.
Dedicated cold storage wallets
A more convenient and secure option is dedicated cold storage wallets, which can remain offline even when signing transactions. This may sound like magic, but the way it works is the following:
The electronic wallet is set up on an offline device (such as an old laptop, tablet or special hardware), using a previously downloaded program. A “watch only” copy (ie., only the public key, so it can only consult, not transact) is imported to your online computer using a pendrive, USB stick, or whatever you want to call it. This copy creates the transaction using the copied public key, and copies the transaction file onto the same USB device (or a different one, if you happen to have many lying around). The transaction is then imported into the software on the offline device, where it is signed using the private key. The signed transaction then gets downloaded onto the USB drive, and imported into the wallet software on the online device, which then broadcasts it to the network. There’s a lot of flaffing about with USB sticks, but your cold storage never “touches” the internet.
A new generation of gadgets promise to make cold storage even easier. Trezor, Ledger, KeepKey and Hardbit are some examples of the devices that make it easier to sign offline and then broadcast the transaction to the network. Most require plugging into an online computer, but strong encryption and barriers to keystroke hacking prevent an “attacker” (what the sector calls someone trying to get at your information) from getting access to the private key information stored there.
— x —
Cold storage is a recommendable solution for keeping significant bitcoin holdings safe. As with all ultra-secure options, though, it is not very straightforward, and should be used for storage, not for frequent transactions. Just as you keep most of your money in the bank but carry around cash for convenience even though it’s less safe, cold storage wallets are secure but online or mobile wallets are more convenient.
Bitcoin security is getting more and more attention these days, partially fuelled by media reports of hacking and theft, but also by more of us waking up to the idea that bitcoin is not just a payment mechanism. It is also an investment*, and investments need a different treatment than digital currencies bought for transaction purposes. Xapo is even developing a system that will allow you to store your bitcoins in outer space. Assuming that the satellite is recoverable, that removes any concern about jurisdictional risk, and highlights the importance of contemplating the worst case scenario. For anyone bullish on the potential value of the digital currency, the value and usefulness of cold storage, earth-bound or not, is becoming more obvious.
(*I am not recommending bitcoin as an investment. It is illiquid and risky, and you should form your own opinion before buying for investment purposes.)