Avatar
Matt Corallo
3d2e51508699f98f0f2bdbe7a45b673c687fe6420f466dc296d90b908d51d594
10th known contributor to Bitcoin Core. Now Full-Time Open-Source Bitcoin+Lightning Projects at Spiral (Part of Block).

Yea, someone probably should. Probably one of the hardware wallet vendors who are complaining that there’s no standard and that’s why they never bothered to implement it (nevermind that it’s implemented in secp256k1-zkp and can be done at the HWI driver layer, but indeed it’s be better as a PSBT field).

Look like nostr:npub1az9xj85cmxv8e9j9y80lvqp97crsqdu2fpu3srwthd99qfu9qsgstam8y8 is avoiding opinions he disagrees with on his podcast, so which one should I go on instead to talk about hardware wallet issues?

The issue with exfil is that the computer can’t detect whether the nonce is malicious or not, so it can’t block the attack. What you really want is for the nonce used to sign to be provably random, by simply having the computer add some of its own randomness to nonce, plus some deterministic message+pk hash from the hardware wallet (ala 6979). That way the HWW cannot exfil.

While you’re at it you should also include randomness from the computer in the seed generation process so that the private keys themselves don’t rely on only the HWW.

Neither of these are complicated, FROST is built around the same kind of nonce agreement protocol and including the randomness from the computer in key gen is just a matter of adding a second private key.

If you sign on two devices and check that they match, yes, that addresses the issue, but now you have two devices with your seed and a very annoying UX (that might also fail due to fine signature grinding differences).

Really HWWs need to implement anti-exfil and generate keys with computer randomness - there’s no excuse for the fact that hardware wallets are trusted, they don’t need to be!

You can definitely include a GSM chip for cheap, but now the device board actually looks visually different, which people can identify, even if admittedly relatively few would. Still, if you did this en-masse it’d likely be discovered before too long, whereas a malicious firmware likely would not.

How about you have me on your bitcoin review show and we chat about it in detail so we can get into all the technical details and how realistic various attacks are :). nostr:note1ftmvf7qlfnpvfjv5cd80980qds4xzvemqyd2kcldcf5tfnlmsxnsy6k6qd

Replying to Avatar Leo Wandersleb

Should we take Bitcoin Core seriously?

To nostr:npub1az9xj85cmxv8e9j9y80lvqp97crsqdu2fpu3srwthd99qfu9qsgstam8y8's credit there is no established standard for PSBTs with anti-klepto and people go on about recommending TAILS instead of hardware wallets missing one of my favorite aspects of hardware wallets: Not only are hardware wallets designed to protect the user from a compromised companion app but the companion app also can verify what the hardware wallet is doing.

Just as with multi vendor multi signature you can remove single points of failure, multi vendor between companion app and hardware wallet can remove single points of failure. With TAILS, that TAILS boot device and the PC it runs on are single points of failure.

Bitcoin Core should support anti-klepto between an online networking instance and an offline signing instance. The TAILS with Sparrow stack is way too complex to safely say it won't use biased nonces else but if it has to use anti-klepto, there is no room for leaking keys.

AFAIU you can implement it entirely in the driver rather than in the wallet itself (BitBox apparently did this for their HWI driver).

Except you aren’t…it’s very (cryptographically) easy to build a hardware wallet which cannot steal your coins*! But no one does, that’s absurd!

* without cooperating with your computer/phone.

You can just download those software packages once and rarely upgrade and you’re safe. Unlike a compromised HWW which can lie to you about the status of its firmware.

Oops, sorry, I forgot we can fix both sides of malicious hardware wallets - a malicious hardware wallet should not be able to steal your coin, it’s not complicated to force attackers to compromise both your computer *and* hardware wallet, but current devices just…. Don’t. That’s embarrassing!

(Except for multisig setups). nostr:note1m80q3p6pfxl6elt7dcpu076fmcwjymz942z4esumm5ku3mrsz2lqanga9y