MIME-Version: 1.0
References: <VZTbLR9RlkkyNg6mOOIxedh7H0g8NGlaCmgBfCVXZ4RNfW3axefgoTqZGXjAQZFEuekujVGjRMv8SifDIodZ6tRGaaXQ_R63rFa03SGS6rg=@wuille.net>
In-Reply-To: <VZTbLR9RlkkyNg6mOOIxedh7H0g8NGlaCmgBfCVXZ4RNfW3axefgoTqZGXjAQZFEuekujVGjRMv8SifDIodZ6tRGaaXQ_R63rFa03SGS6rg=@wuille.net>
From: Dustin Dettmer <dustinpaystaxes@gmail.com>
Date: Mon, 23 Mar 2020 07:38:45 -0700
Message-ID: <CABLeJxQsse99aw35DxSDOyVTruFCgi0hmZntvgbYtPLSRGQ+xA@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>, 
 Pieter Wuille <bitcoin-dev@wuille.net>
Content-Type: multipart/alternative; boundary="0000000000005cf09105a1869817"
Subject: Re: [bitcoin-dev] Overview of anti-covert-channel signing techniques
Precedence: list

--0000000000005cf09105a1869817
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Excellent write up, thanks for putting it together.

On Tue, Mar 3, 2020 at 1:47 PM Pieter Wuille wrote:

> When both the HW and the SW are compromised, clearly no security is
> possible,
> as all entities are controlled by the same party in that case.
>
While all SW being compromised can=E2=80=99t be stopped, splitting the SW o=
ver two
stages can dramatically increase your security if both HW & SW are
compromised. You can do that by:

1) When you setup your storage solution (whatever it may be), export the
xpub(s) and verify the receiving addresses match xpubs with external
software before receiving.
2) Generate and export withdrawal transactions offline
3) Verify transactions against the same xpub(s) using external software
4) Upload transactions

This mitigates, I believe, all leak vectors besides k/R hacking and
prechosen entropy.

I made an external tool to just that here:
https://github.com/koinkeep/gatekeeper

Would love to add k commitments when (if?) we settle on best practices for
it.

--0000000000005cf09105a1869817
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div><div dir=3D"auto">Excellent write up, thanks for putting it together.<=
/div></div><div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gm=
ail_attr">On Tue, Mar 3, 2020 at 1:47 PM Pieter Wuille wrote:</div><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s=
olid;padding-left:1ex">When both the HW and the SW are compromised, clearly=
 no security is possible,<br>
as all entities are controlled by the same party in that case.<br>
</blockquote></div></div><div dir=3D"auto">While all SW being compromised c=
an=E2=80=99t be stopped, splitting the SW over two stages can dramatically =
increase your security if both HW &amp; SW are compromised. You can do that=
 by:</div><div dir=3D"auto"><br></div><div dir=3D"auto">1) When you setup y=
our storage solution (whatever it may be), export the xpub(s) and verify th=
e receiving addresses match xpubs with external software before receiving.<=
/div><div dir=3D"auto">2) Generate and export withdrawal transactions offli=
ne</div><div dir=3D"auto">3) Verify transactions against the same xpub(s) u=
sing external software</div><div dir=3D"auto">4) Upload transactions</div><=
div dir=3D"auto"><br></div><div dir=3D"auto">This mitigates, I believe, all=
 leak vectors besides k/R hacking and prechosen entropy.</div><div dir=3D"a=
uto"><br></div><div dir=3D"auto">I made an external tool to just that here:=
=C2=A0<div><a href=3D"https://github.com/koinkeep/gatekeeper">https://githu=
b.com/koinkeep/gatekeeper</a></div></div><div dir=3D"auto"><br></div><div d=
ir=3D"auto">Would love to add k commitments when (if?) we settle on best pr=
actices for it.</div>

--0000000000005cf09105a1869817--