cryptographile

A few words given the recent exploits on hardware signing devices: • The Ledger supply chain attack represents one of the most sophisticated attacks thus far on the wallet ecosystem. In many ways it’s a lot more sophisticated than the Coldcard RNG exploit, because that one was software only. This one took a cross-border company buyout, tampering with the devices (implanting an eSIM, an LTE module and a CPU) and manufacturing the implants at scale. • These sorts of attacks have been predicted by early Bitcoiners, but in Bitcoin they remained theoretical or crude until this year. It shows that the level of sophistication of attacks has risen quickly, and what was previously “good enough” advice on wallets and self-custody is no longer sufficient. • When we started Nunchuk a few years ago, our premise was that multisig, and multi-vendor multisig, needs to become the standard for self-custody in the future. But even we didn’t expect how fast it would materialize. This is likely due to 2 factors: Bitcoin getting more mainstream, and the rise of AI-assisted attacks. This is a Sputnik moment for Bitcoin self-custody. The defenses need to level up. • Passphrases wouldn’t have helped in the Ledger case, since you are required to enter the passphrase into the device for it to sign any transactions. A compromised device that phones home the seed phrase can also easily phone home the passphrase the moment you enter it. • Similarly, generating the private key somewhere else (even by rolling dice) and subsequently importing it onto a tampered device wouldn’t save you here. The device can phone home the seed phrase the moment it’s imported. • Anti-tampering techniques might help, such as transparent casing or bricking the device if it’s tampered with. Or forever displaying a message once the seal is broken. Or using on-device encryption between the internal hardware components. But a dedicated and resourceful enough attacker can still find ways to get around these layers. Tampering and anti-tampering have long been a cat-and-mouse game. In 2008, card readers doctored right off a Chinese production line sent card data and PINs over mobile networks to Pakistan. The Ledger attack is the same playbook, 18 years later. The bigger the target, the more attackers spend on overcoming the defenses. • You should order directly from the vendors as much as possible, using a PO box for privacy. • Any setup that relies on a single hardware/software stack or a single vendor should be considered at risk. • Building your own hardware signers from generic parts is a good option for technical users. • Multi-vendor multisig should become the standard. Each signer should have a completely independent hardware/software stack from the other signers. The point is that there shouldn’t be any single-point-of-failure anywhere in your setup. • Many advanced protocols rely on timelocks and the recovery path being a simple singlesig. The recent attacks and exploits should highlight how dangerous this could be. Timelocks simply delay a risk. If a seed is compromised and there’s a timelock involved, the attacker just needs to wait out the timelock. (For Miniscript wallets, there’s the wallet descriptor too, but presumably it also gets sent to the device at some point.) Vault-like protocols face a similar problem: any withdrawal or recovery path that relies on a single key is a potential single point of failure. • For our on-chain timelock-assisted wallets, in a few weeks we are adding the option to customize the recovery path to be an M-of-N, so that, if you want, spending would require multiple keys at all points during the wallet’s lifetime.