$610 million stolen from Ronin bridge
How does ChainX keep user assets safe?
People have heard about the $610 million theft from the Ronin Network. Here we will not repeat the process of this incident. The key is, how does ChainX ensure that user assets will not be stolen?
1. The most critical point is, Taproot. We refer to this concept many times, but people may not fully understand it.
ChainX’s custodians use the ComingChat threshold wallet with Taproot technology for multi-signature. Each trust keeps its own private key fragments, and these private key fragments are aggregated off-chain to form aggregated private keys and aggregated public keys.
In the traditional multi-signature scheme, people can know the address (public key) of each trust from the chain. Based on these addresses, hackers then use further methods to steal the private keys corresponding to these addresses. Taproot fundamentally solves this problem. The Schnorr algorithm can realize the off-chain aggregation of private key fragments, so the outside world can only see a new address aggregated from the addresses of the 10 trustees on the chain, and people cannot even know whether it is an ordinary single signature or Multi-signature. If it is impossible to know the respective addresses of each trust, it is naturally impossible to know the respective private keys of each trust. This ensures the absolute security of user assets.
2.ComingChat — Signal protocol group chat design
The custodian of the ChainX network first establishes an encrypted group in the ComingChat APP, and then initiates multi-signature in the group. Since ComingChat’s encrypted group adopts the Signal protocol, any message from the custodian is absolutely confidential.
Signal protocol is a real end-to-end communication encryption protocol and the most secure communication protocol in the world. No third party including the server can view the communication content.
Signal Protocol group chat is encrypted communication through KDF ratchet algorithm + public key signature. The communication flow is like this,
(1) Each group member must first generate a random 32-byte KDF Chain Key, which is used to generate a message key to ensure the forward security of the message key, and a random Curve25519 signing key pair, used for message signing.
(2) Each group member encrypts and sends the Chain Key and the signature public key to other members individually. At this point, each member has the chain key and signature public key of all members in the group.
(3) When a member sends a message, first encrypt the message with the message key generated by the KDF chain ratchet algorithm, then use the private key to sign, and then send the message to the server, and the server sends it to other members.
(4) After other members receive the encrypted message, they first use the sender’s signature public key to verify, and after the verification is successful, use the corresponding chain key to generate the message key and decrypt it with the message key.
To sum up, The asset custody model of ChainX ensures the absolute security of users’ bitcoin assets by adopting multi-party secure computing, namely aggregated signature (Taproot) + distributed privacy computing (Signal protocol).
You can always trust ChainX.
