“I Can’t Believe It’s Not Custodial!”: Usable Trustless Decentralized Key Management

Document Title

"I Can’t Believe It’s Not Custodial!" Usable Trustless Decentralized Key Management

Document Information

• Subject Area: Human-Computer Interaction and Decentralized Key Management
• Keywords: Key management, multi-factor authentication, decentralization, user experience, crypto wallets, cryptography, system usability, MFKDF, client-side storage, blockchain

Research Background and Problem Statement

• Problems and Challenges:

  • Key management has long been an unresolved challenge in the field of usable security, particularly in distributed or decentralized applications.
  • Traditional password-based key derivation functions (PBKDFs) face limitations in decentralized contexts, such as low entropy, insufficient security, and lack of recovery mechanisms.
  • Current mainstream non-custodial crypto wallets face several pain points: difficulty in portability, poor recovery options, and heavy reliance on single devices or hardware components.
  • Users often opt for more user-friendly centralized wallets, which undermines the decentralized nature of blockchain assets, especially when custodial services fail (e.g., the collapse of FTX impacting trust).

• Research Motivation and Related Work:

  • MFKDF (Multi-Factor Key Derivation Function) is an emerging cryptographic mechanism that supports multi-factor authentication (MFA) and provides password recovery mechanisms, aiming to address the core pain points of non-custodial key management.
  • This paper also examines whether MFKDF can achieve "custodial-level" convenience in user experience while maintaining decentralized security, through comparisons with traditional custodial wallets (e.g., Coinbase) and non-custodial wallets (e.g., MetaMask).

Solution

• Research Methodology:

  • Proposed the design and implementation of an Ethereum wallet based on MFKDF.
  • Conducted a user study (27 participants) to compare the usability differences between the MFKDF wallet and traditional custodial and non-custodial wallets.

• Core Technologies/Implementation Steps:

  1. MFKDF Mechanism:
     • Combines user passwords, dynamic OTP codes, and other factors to derive keys in real-time.
     • All public parameters are stored on public blockchains or IPFS networks, eliminating the need for centralized storage.
     • Implements a distributed recovery mechanism (e.g., based on key sharding techniques).
  2. Experimental Wallets:
     • Custodial Wallet (Wallet A): Stores keys on a server, supports recovery via email and TOTP.
     • Non-Custodial Wallet (Wallet B): Keys are generated and stored client-side (JSON file + seed phrase).
     • MFKDF Wallet (Wallet C): Derives keys in real-time, combining decentralization principles with multi-factor authentication.
  3. User Experiment Design:
     • Designed tasks such as account creation, device import/login, and account recovery for the three wallet prototypes.
     • Measured quantitative metrics such as task completion time, success rate, and SUS (System Usability Scale) scores, while recording subjective preferences and behavioral patterns.

• Innovations:

  • First application of MFKDF technology to non-custodial crypto wallets, proposing a trustless key management system that balances security and recoverability.
  • User study isolates interface, branding, and other variables to focus solely on the impact of the core technology (MFKDF).

Research Findings

• Specific Results:

  • SUS Scores: The MFKDF wallet achieved an average score of 87.94, significantly outperforming traditional non-custodial wallets (60.88, p < 0.0001).
  • Task Completion Time: For critical tasks such as registration, login, and key recovery, the MFKDF wallet was significantly faster than traditional solutions, with an overall improvement of 71%.
  • In terms of subjective preferences, most users favored the convenience and trustworthiness of the MFKDF wallet, noting that it combines the usability of custodial wallets with the security of non-custodial wallets.

• Advantages:

  • Recoverability: Users can efficiently regain access even after forgetting their passwords, without relying on centralized servers.
  • Compatibility: Suitable for decentralized applications with minimal trust requirements.
  • Portability and Security: The key derivation mechanism reduces access issues caused by device loss or single points of failure.

• Limitations and Future Directions:

  • Limitations:
    1. The three wallet interfaces used in the experiment were custom-developed, which may partially deviate from the user experience of real-world wallets.
    2. The sample of 27 participants was concentrated in the U.S., with a gender imbalance, limiting the diversity of the study population.
  • Future Directions:
    1. Explore the generalizability of MFKDF in broader cryptographic applications (e.g., cloud storage, disk encryption, network security protocols).
    2. Further optimize accessibility for users with disabilities, such as blind users.
    3. Enhance technical education and awareness of MFKDF, building greater trust in decentralized wallets within user communities.