<p>Cardano uses the Hierarchical Deterministic key generation scheme (specifically that of BIP44-ed25519), which is an offline process that can be done without an internet connection. As such, there is no way to know that your master key has been compromised unless it is used to submit a transaction. However, clever use of NFTs and Plutus scripts enable us to construct a variety of risk-management protocols with associated trade-offs. Even simple constructions as outlined <a href="https://github.com/input-output-hk/cardano-node/blob/master/doc/reference/simple-scripts.md" rel="nofollow noreferrer">here</a> may be used create highly complex output gaurds.</p>
<p>A super simple example is that of a &quot;death protection&quot; scheme that I use with my family. My primary key is under my secure control, but in the event that key becomes inaccessible, there is a second, highly accessible key that is only unlocked 10 years from now. Here's the JSON formula I use to build the script-address:</p>
<pre><code>{
  &quot;type&quot;: &quot;any&quot;,
  &quot;scripts&quot;:
  [
    {
      &quot;type&quot;: &quot;sig&quot;,
      &quot;keyHash&quot;: &quot;&lt;PRIMARY KEYHASH&gt;&quot;
    },
    {
      &quot;type&quot;: &quot;all&quot;,
      &quot;scripts&quot;:
      [
        {
          &quot;type&quot;: &quot;after&quot;,
          &quot;slot&quot;: &lt;FUTURE SLOT NUMBER&gt;
        },
        {
          &quot;type&quot;: &quot;sig&quot;,
          &quot;keyHash&quot;: &quot;&lt;EMERGENCY KEYHASH&gt;&quot;
        }
      ]
    }
  ]
}
</code></pre>
<p>However, no matter the complexity/design of your scheme, a permissionless blockchain <em><strong>without</strong></em> trusted third-parties will <strong>NEVER</strong> protect you against catastrophic loss of a master secret.</p>
<p>The only real way around this is to admit some form of centralization/third-party authentication. The question then becomes, in what form should such insurances be?</p>
<p>IOHK actually wrote <a href="https://iohk.io/en/research/library/papers/w-otsup-my-sleevea-hidden-secure-fallback-for-cryptocurrency-wallets/" rel="nofollow noreferrer">this</a> paper about &quot;proofs-of-ownership&quot; and &quot;secure hidden fallback&quot; mechanisms that may be leveraged for such purposes.</p>
<p><strong>Quick Summary:</strong></p>
<p>A <em>back-up key</em> can be created upstream of the initial key derivation; one that is never used, even for signing transactions. The only time one would use it is to prove ownership of a child signing key. Ideally, such keys would never see the light of a network and would be kept separate from the primary signing keys. These back-up keys can be used to prove ownership of their associated wallets. This can be extremely useful in the event a (side)chain is rolled back due to some massive security flaw, among other scenarios.</p>

CC BY-SA 4.0
2021-11-28T23:15:01.580Z
Thanks for the response! Do you happen to have a write up of the details of this death protection scheme, I am very interested in that. So the Plutus script time locks were the kind of thing I was envisioning for this type of protection. I was just wondering if there would be a way to build that into the protocol and if it would be worth it. I am more thinking along the lines of proof of access vs proof of ownership. I do understand there is no way to detect offline access.
Jacob - SNOWY Pool
CC BY-SA 4.0
2021-11-28T23:31:36.060Z
No problem! I edited the original answer to include the death-protection scheme.
zhekson
CC BY-SA 4.0
2021-11-28T22:55:41.740Z
2021-11-28T23:30:57.783Z
2021-11-28T23:30:57.783Z
zhekson
<p>There is no such thing as wallet-restoral or even initialization on the blockchain. These are purely client-side events happening on the device of the user. As such, there is no way to check if someone in the world has setup a wallet with your keys.</p>
<p>However, what follows after a wallet is set up is that it queries the connected node for available funds. I’m pretty sure that a standard node such as the one from Yoroi does not track which funds of which keys have been queried. But in principle this would be the action that would be traceable. If the thief checks your funds on his own node, however, (for example in Daedalus) there is truely no way to trace this.</p>

CC BY-SA 4.0
2021-11-28T22:52:00.443Z
This is pretty much what my understanding of this was as well. Do you know why there isn't any kind of wallet restoration event recorded on the blockchain? I realize solutions to this could get complicated really quickly but I guess I am wondering if it is a 'not worth the effort' or if there is a technical reason why a restoration event isn't recorded (I also didn't see any other blockchains that do this either). Maybe the additional transaction fees aren't worth this little benefit?
Jacob - SNOWY Pool
CC BY-SA 4.0
2021-11-28T22:59:24.957Z
I'd imagine that any sort of "restoration" mechanic poses a massive risk to the legitimacy of a chain because people would abuse it themselves.
zhekson
CC BY-SA 4.0
2021-11-28T23:06:06.210Z
@nomad0, could you give an example of abuse for this?
Jacob - SNOWY Pool
CC BY-SA 4.0
2021-11-28T23:14:29.637Z
Sorry for not clarifying, I imagine something along the lines of: I pay you for a legitimate product/service, then claim the transaction was unauthorized and attempt to rollback. Many systems can compensate for this, such as you (the vendor) being able to challenge my rollback request. But now we need arbiters, and things get real weird real quick.
zhekson
CC BY-SA 4.0
2021-11-28T23:20:41.797Z
Oh yeah that makes a lot of sense. So I am not thinking proof of ownership as much as just proof of access. Thinking along the lines of a wallet is restored and there is a time lock on the use for that specific restoration (not exactly sure how this would work, maybe mac addresses?). This would allow someone to create a watch service that you subscribe to, to know someone restored the wallet. This would give you time to save your funds while the time lock was active.
Jacob - SNOWY Pool
CC BY-SA 4.0
2021-11-29T19:29:02.363Z
Jey, you and nomad0 answered the first bold question but the details of the second question are why I chose nomad0 for the answer. He mentioned the use of time-locks with smart contracts as a solution to this. Also, down voting the question because your answer wasn't accepted is not productive.
Jacob - SNOWY Pool
CC BY-SA 4.0
2021-11-29T22:27:14.597Z
I have no problem with my answer not being accepted. I did not notice the second part and downvoted the question upon seeing it because together with the accepted answer, I think it is confusing and would mislead someone seeking to understand.
Jey
CC BY-SA 4.0
2021-11-29T23:15:08.193Z
Thanks for the clarification, @Jey. Any suggestions to editing the question to make it less confusing?
Jacob - SNOWY Pool
CC BY-SA 4.0
2021-11-28T20:14:31.470Z
2021-11-28T20:14:31.470Z
Jey
<p>In most cases, I would assume that if your wallet is compromised, your funds are going to be stolen and that is how you are going to know it is compromised. However, let's assume a hypothetical threat actor get's your private keys, and then restores the wallet without making any transactions (without stealing). As an example as to why a threat actor might do this, let's assume that you only have 100 Ada in your wallet and they think you'll deposit more into it later on. In other words, they are going to wait it out hoping to steal more.</p>
<p>My question is: <strong>Is there currently a way to know if someone has restored/accessed your wallet without them creating a transaction with your keys?</strong></p>
<p>My understanding is that there is not, so if that is true, my next question is: <strong>What could be done, potentially a <a href="https://github.com/cardano-foundation/CIPs" rel="nofollow noreferrer">CIP</a>, that could mitigate this?</strong></p>

<wallet><security><cip>
Is there a way to know if your wallet was restored (accessed) without a transaction being made?
# Is there a way to know if your wallet was restored (accessed) without a transaction being made?

(Asked by: username_0 on 2021-11-28)

In most cases, I would assume that if your wallet is compromised, your funds are going to be stolen and that is how you are going to know it is compromised. However, let's assume a hypothetical threat actor get's your private keys, and then restores the wallet without making any transactions (without stealing). As an example as to why a threat actor might do this, let's assume that you only have 100 Ada in your wallet and they think you'll deposit more into it later on. In other words, they are going to wait it out hoping to steal more.

My question is: **Is there currently a way to know if someone has restored/accessed your wallet without them creating a transaction with your keys?**

My understanding is that there is not, so if that is true, my next question is: **What could be done, potentially a [CIP](https://github.com/cardano-foundation/CIPs), that could mitigate this?**

**Tags:** wallet, security, cip

---

## 2 answers

### Answer by username_1 on 2021-11-28. Score: 2 | Accepted answer

Cardano uses the Hierarchical Deterministic key generation scheme (specifically that of BIP44-ed25519), which is an offline process that can be done without an internet connection. As such, there is no way to know that your master key has been compromised unless it is used to submit a transaction. However, clever use of NFTs and Plutus scripts enable us to construct a variety of risk-management protocols with associated trade-offs. Even simple constructions as outlined here may be used create highly complex output gaurds.
A super simple example is that of a "death protection" scheme that I use with my family. My primary key is under my secure control, but in the event that key becomes inaccessible, there is a second, highly accessible key that is only unlocked 10 years from now. Here's the JSON formula I use to build the script-address:
{
  "type": "any",
  "scripts":
  [
    {
      "type": "sig",
      "keyHash": ""
    },
    {
      "type": "all",
      "scripts":
      [
        {
          "type": "after",
          "slot": 
        },
        {
          "type": "sig",
          "keyHash": ""
        }
      ]
    }
  ]
}

However, no matter the complexity/design of your scheme, a permissionless blockchain without trusted third-parties will NEVER protect you against catastrophic loss of a master secret.
The only real way around this is to admit some form of centralization/third-party authentication. The question then becomes, in what form should such insurances be?
IOHK actually wrote this paper about "proofs-of-ownership" and "secure hidden fallback" mechanisms that may be leveraged for such purposes.
Quick Summary:
A back-up key can be created upstream of the initial key derivation; one that is never used, even for signing transactions. The only time one would use it is to prove ownership of a child signing key. Ideally, such keys would never see the light of a network and would be kept separate from the primary signing keys. These back-up keys can be used to prove ownership of their associated wallets. This can be extremely useful in the event a (side)chain is rolled back due to some massive security flaw, among other scenarios.

> **Comments:**
> **username_0**: Thanks for the response! Do you happen to have a write up of the details of this death protection scheme, I am very interested in that. So the Plutus script time locks were the kind of thing I was envisioning for this type of protection. I was just wondering if there would be a way to build that into the protocol and if it would be worth it. I am more thinking along the lines of proof of access vs proof of ownership. I do understand there is no way to detect offline access.  
> **username_1**: No problem! I edited the original answer to include the death-protection scheme.  

---

### Answer by username_2 on 2021-11-28. Score: 1

There is no such thing as wallet-restoral or even initialization on the blockchain. These are purely client-side events happening on the device of the user. As such, there is no way to check if someone in the world has setup a wallet with your keys.

However, what follows after a wallet is set up is that it queries the connected node for available funds. I’m pretty sure that a standard node such as the one from Yoroi does not track which funds of which keys have been queried. But in principle this would be the action that would be traceable. If the thief checks your funds on his own node, however, (for example in Daedalus) there is truely no way to trace this.

> **Comments:**
> **username_0**: This is pretty much what my understanding of this was as well. Do you know why there isn't any kind of wallet restoration event recorded on the blockchain? I realize solutions to this could get complicated really quickly but I guess I am wondering if it is a 'not worth the effort' or if there is a technical reason why a restoration event isn't recorded (I also didn't see any other blockchains that do this either). Maybe the additional transaction fees aren't worth this little benefit?  
> **username_1**: I'd imagine that any sort of "restoration" mechanic poses a massive risk to the legitimacy of a chain because people would abuse it themselves.  
> **username_0**: @nomad0, could you give an example of abuse for this?  
> **username_1**: Sorry for not clarifying, I imagine something along the lines of: I pay you for a legitimate product/service, then claim the transaction was unauthorized and attempt to rollback. Many systems can compensate for this, such as you (the vendor) being able to challenge my rollback request. But now we need arbiters, and things get real weird real quick.  
> **username_0**: Oh yeah that makes a lot of sense. So I am not thinking proof of ownership as much as just proof of access. Thinking along the lines of a wallet is restored and there is a time lock on the use for that specific restoration (not exactly sure how this would work, maybe mac addresses?). This would allow someone to create a watch service that you subscribe to, to know someone restored the wallet. This would give you time to save your funds while the time lock was active.  
> **username_0**: Jey, you and nomad0 answered the first bold question but the details of the second question are why I chose nomad0 for the answer. He mentioned the use of time-locks with smart contracts as a solution to this. Also, down voting the question because your answer wasn't accepted is not productive.  
> **username_2**: I have no problem with my answer not being accepted. I did not notice the second part and downvoted the question upon seeing it because together with the accepted answer, I think it is confusing and would mislead someone seeking to understand.  
> **username_0**: Thanks for the clarification, @Jey. Any suggestions to editing the question to make it less confusing?  

---

