Actor

A person, organization, system, or service that (for the purposes of this specification) makes direct use of a cryptographic key or seed is an actor in the context of that key or seed.

Address

A cryptocurrency address is (usually) an encoded form of a public key from a wallet that can be used as the recipient of a transaction. In multi-signature schemes, an address may be an encoding of information including several public keys and/or other information as in the case of a bitcoin P2SH address.

Approved Communication Channel

A communication channel that provides high confidence of the identities of the communicating parties as approved by the entity. This could be a voice call where the sound of their known voice is verified, a digitally-signed message (using strong encryption such as PGP/GPG or S/MIME), or a combination of multiple separate channels that are unlikely to be simultaneously compromised, such as an email + an SMS message + an instant message via Slack.

Deterministic Random Bit Generator

A kind of PRNG that can produce some number of values (usually keys) from a single seed. DRBGs are primarily useful due to their ability to limit a system’s reliance secure sources of entropy.

Digital Signature

A mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very strong reason to believe that the message was created by a known sender (authentication), and that the message was not altered in transit (integrity).

Entropy

Randomness usually collected from hardware, environmental factors (time of execution), or external sources (user-input). Wikipedia

Factor of Authentication

Multi-factor authentication schemes require multiple demonstrations of identity. The most common example is a username and password combination, where each input is a factor of authentication. To access protected information in this scheme, an actor must provide those two pieces of information. Additional factors generally (although with diminishing returns) increase the security of the system. Common examples include:

• A TOTP token may be required, where the token can only be obtained from a device seeded with the TOTP secret (Google Authenticator), which effectively requires the actor be in possession of a specific pre-authorized device.
• An OTP can be delivered to a phone number via SMS, MMS, or a voice call.
• A biometric scan may be required - although this is usually only useful if the access point is in a controlled and trusted environment.

Colloquially, a username is not considered a factor of authentication since usernames are not commonly secret information. The same applies to email addresses, phone numbers, and other pieces of data which only “identify” actors. The requirement imposed by a factor of authentication should only be satisfiable by the actor identified.

Hierarchical Deterministic Wallet