Cubist Launches Bank-Grade Ethereum Key Management Service

Cubist, a platform that uses bank-grade hardware to manage the keys that control digital assets, has launched a service aimed at institutional blockchain staking providers, timed to coincide with the arrival of staking deposits and withdrawals on Ethereum.

The firm’s founding team of professors in cryptography from Carnegie Mellon University and the University of California San Diego have sought to replace the current array of cobbled-together and counterintuitive solutions that risk raw keys being exposed while signing transactions.

Up until Ethereum’s recent Shapella network upgrade, validators did not have the option to remove the tokens they had locked up in the preliminary stage of the public blockchain’s staking system.

While the inability to destake was something of a downside, it did have an upside, at least from a security perspective, said Cubist CEO Riad Wahby. Nobody could touch that money, not even its owner.

“The ability to destake can be nerve-wracking because these machines have to be online all the time, so it’s not like having 30 ETH in a cold wallet,” said Wahby in an interview with CoinDesk. “The machine has a key and is using that key all the time. Most of the solutions out there opt for convenience and store the key on the machine, and just hope that machine doesn’t get hacked.”

Cubist’s approach is to store staking keys in hardware security modules (HSM), physical computing devices that carry out digital signatures and can provide evidence if tampered with.

“HSMs are the gold standard in the banking industry, and for a good reason,” said Wahby. “Conceptually an HSM means your key is bound to a physical object. That’s very different from a case where somebody puts malware on your computer and silently copies your keys, and then a few weeks later the hack happens.”

“We chose Cubist because their team includes preeminent experts in applied cryptography and systems security,” said Ankr co-founder Stanley Wu in a statement. “They are uniquely qualified to secure Ankr’s most critical workflows.”

DISCLOSURE