Ask HN: How do you use Bitcoin in a trustless way?

[JonathanBeuys]

I'm still trying to figure out, if it is possible to use Bitcoin in a trustless way. So that no matter which parts of your tech stack are faulty or malicious, you keep control over your funds.

The following is what I got so far. I never used Bitcoin. So correct me, if something is wrong please.

1: Create a seed phrase with dices

2: Write it down on paper or carve it into metal

3: Buy a hardware wallet with no internet connectivity.

4: Never connect that wallet to any other device.

5: Type the seed phrase into the hardware wallet

6: The hardware wallet will display an extended public key

7: Install a software wallet on a computer with internet access

8: Type the extended public key into the software wallet

9: To do transactions: Create a transaction in the software wallet

10: The software wallet will show a hash of the transaction

11: Type that hash into the hardware wallet

12: The hardware wallet will show a signature

13: Type that signature into the software wallet

That's it.

As I understand it, there still is trust involved in steps 3 and steps 6:

3: There is not an easy way to check if the hardware wallet really has no internet connectivity.

6: There is no way to check if the hardware wallet really uses the seed phrase to create the extended public key. It could create an extended public key that the vendor can predict. One could test it a few times with throw-away seed phrases, but one would never be 100% sure.

[globalreset]

Decent breakdown. Good job.

8. You can usually export it more conveniently. 10-13 is overkill. Most wallets have some reasonable way to move txes between hardware wallet and online system (like SD card). They don't really compromise the practical security and are a much better UX.

3. checking if hardware really have no internet connectivity is indeed a thing. You could use Faraday Cage to be certain. Some wallets like ColdCard are translucent so you can inspect the components.

6. It is maximally secure to generate seed phrase manually using dices and paper lookup table. If you enter it into two wallets from two different vendors, you can see if they generate same addresses.

There's one attack you're missing: Hardware wallets could possibly slowly leak your private key by biasing bits in the signatures by grinding nonce. It would take whole lot of txes, but it is theoretically possible.

There's also possibility of someone just analyzing the electromagnetic waves during hw wallet signing txes to extra a key. Very very sophisticated and unlikely, but since we already have the tin foil hat on... just invest in Faraday Cage. :D

For maximum tin foil hat security, use multisig between two or more different devices (and/or parties), signing in different locations.

Edit: Oh. And since you're so into it it's worth mentioning that using seed passphrase is always a good idea!

[redox99]

> There's one attack you're missing: Hardware wallets could possibly slowly leak your private key by biasing bits in the signatures by grinding nonce. It would take whole lot of txes, but it is theoretically possible.

That's really cool. I had never thought of that.

All these points make me think that the best way is ditching the hardware wallet, and creating your own hardware wallet on a generic, airgapped PC where you write your own software (you always hear don't roll your own crypto, but in these case where you don't have to worry about side channel attacks, and you would do the random generation with dice, it should be fine).

In such case you're only relying on lets say, Intel, an airgapped generic Linux, GCC and maybe something else. But all these are things that would be extremely hard to modify in a way to affect your custom written software on an airgapped PC.

Plus the incentives to do some sophisticated but funny business on a commercial Hardware Wallet is quite high. While adding such sophisticated attack to GCC or Intel chips somehow would be extremely unlikely.

Add to this multisig with other methods, and the probability of some technical attack is so unlikely compared to a rubberhose attack, that it might as well be 0.

[JonathanBeuys]

8: Using an SD card seems to completely throw the trustlessness regarding the hardware wallet out of the window? How do you know it does not write your seed phrase to the SD?

The "leak via grinding nonce" seems scary. That means signing a transaction is not a deterministic process? The same transaction can be signed in multiple ways?

[operator-name]

Assuming the hardware wallet isn't following convention and impliments RFC 6979 (a huge red flag) that is. At that point the hardware wallet can be considered to do all kinds of messed up stuff - what about a wallet that deletes the private keys after X transactions?

This is actually a realistic failure mode - hardware wallets do fail even if rare.

[TacticalCoder]

(as others have noted multi-sig schemes may be a better option but here are a few infos regarding your questions)

> 1: Create a seed phrase with dices

You can do that but you'll need a way to generate the checksum for the seed phrase. A 24 words BIP39 seed contains 264 bits (24 x 11 bits): 256 bits for the seed and 8 bits for the checksum.

> There is not an easy way to check if the hardware wallet really has no internet connectivity.

Indeed but you can at least open / disassemble some of them easily (there are even docs by the manufacturers explaining how to verify that the hardware wallet's PCB looks legit).

Seed exfiltration, even without connectivity, is an issue too.

And some hardware wallets are extremely noisy and impossible to use totally offline (there are mandatory firmware upgrades and mandatory connectivity needed to install the "apps" that allow to sign transactions), so you have to trust the vendor.

> There is no way to check if the hardware wallet really uses the seed phrase to create the extended public key.

Yes there is. Use an airgapped/offline computer which has physically no network connectivity options (no wifi / no ethernet / no bluetooth / no nothing), no HDD, booted from, say, a live Linux CD with contains for example Ian Coleman's BIP39 tools. Then you enter your seed and verify that the extended public key / keys derived is the same as the one shown by your hardware wallet. Data exfiltration from such a computer is still technically possible but I wouldn't worry too much about it: you power that computer for a few minutes, turn it off, and you'll be fine.

[olalonde]

> You can do that but you'll need a way to generate the checksum for the seed phrase. A 24 words BIP39 seed contains 264 bits (24 x 11 bits): 256 bits for the seed and 8 bits for the checksum.

In theory, you could pick 23 words at random with 11 * 23 coin flips, every 11 flips representing an index in the dictionary. Now to find which 24th word passes the checksum, you could guess it in at most 2048 attempts on your hardware wallet :)

More realistically, it might be possible to develop a Ledger app that, given 23 words, finds the "checksum-passing" 24th word for you.

[yencabulator]

> no HDD, booted from, say, a live Linux CD

I so wish there was a USB stick on the market where you can toggle read-only mode with a physical switch. (And where you had reasonable confidence that the firmware is hard to attack, I guess.)

[rlt]

Instead of a hardware wallet you could buy or build an airgapped PC with no wireless hardware.

Of course it’s possible to exfiltrate data even without dedicated wireless hardware (TEMPEST etc) so I guess build a faraday cage if you’re really paranoid.

Also: https://glacierprotocol.org/

[olalonde]

Mostly agree with your steps except that to sign a transaction, you need all of its data, not just the hash. So it would be impractical to manually type it in a hardware wallet (also, most hardware wallets don't have a keyboard).

Hardware wallets like Ledger instead connect directly to a computer via USB to receive/transmit transactions to sign. They also transmit the extended public key to the wallet software so you don't have to type it manually. You have to trust the hardware wallet vendor to some degree.

Regarding, your comment on number 6, that's an interesting thought that I hadn't considered. Since you are not supposed to enter your seed on a computer, there really isn't any way to verify that the hardware wallet is really using the seed you provided and not some seed that can be predicted by the hardware manufacturer. I guess you could enter it on a hardware wallet from a different vendor, or on an air-gapped computer[0], and see if it matches.

[0] Make sure that the computer is never connected to the Internet again in case there was a key logger running and waiting for Internet connectivity.

[JonathanBeuys]

Wow, the signing of a transaction needs the whole transaction, not just a hash?

I thought there are air gapped hardware wallets?

Without a keyboard, how do you enter your seed phrase?

Connecting the hardware wallet to the computer brings up a bunch of complex security questions.

[larsrc]

You can't. You have to live with the fact that there's some amount of risk and weigh whether it's an acceptable level compared to what you're securing. See Reflections on Trusting Trust for the canonical example.

[JonathanBeuys]

Even though the terms are related, I did not talk about "risk" but about "trust".

If you think there is no way around trusting some party, then please name which party that would be. And why one cannot use Bitcoin without trusting them.

[FatalLogic]

I think you can't. You're right about 3 and 6, which are the same basic issue of needing to trust the vendor, their hardware suppliers, their employees, and the delivery chain to you. (You can be more secure, but you can't be totally secure)

Or, for example, what if all your communications and actions are being monitored continuously by state-level actors with cameras and hidden bugs, recording every keystroke? Or what if we are living in a simulation, and the malicious operators can extract data from your brain, or just alter reality at will?

But I think you can provide a "practical" level of trustless. That means that, if your adversary was powerful enough to steal your Bitcoins, then they'd be so powerful that they could destroy you in many other ways. So it's a moot point.

A practical solution to your question could be to take all the precautions you've said above, and then simply gradually increase the amounts you are transacting, using a variety of methods, and see if anything gets stolen.

Call it a bribe or a bug bounty or a tax. It's quite effective, because organizations are comprised of individuals, who are subject to human temptations. At least two federal agents independently stole funds from the Silk Road marketplace while investigating it, and they were imprisoned later

[JonathanBeuys]

I don't think the bug bounty approach helps.

Say an attacker compromised a certain batch of Ledger wallets.

They might very well wait for a few years before they reap coins of the wallets. Because as soon as they do it for the first time, there will be an uproar and people will analyze whats up and transfer their funds to other wallets.

[strbean]

If you're willing to accept that an individual MOSFET won't be bugged, build your own hardware from individual transistors to do all the necessary cryptographic steps. Run it on a battery supply to avoid power line information leakage[0]. Run the hardware inside a Faraday cage to avoid RF information leakage.

[0]: using a lead acid battery so you can disassemble it and verify it isn't bugged.

[thfuran]

And then, of course, you simply have to rewrite the entire software stack.

[joosters]

You've missed step 0 (and earlier): how did you trustlessly obtain the bitcoin in the first place? Your options aren't good here:

a) Buy it on an exchange: You need to trust that the exchange won't just run off with/sell your real money/credit card details (but at least in the real world you have a chance of clawing back stolen cash)

b) Buy it via a service like localbitcoins, where you meet a stranger in an alley and hand them hard cash. Not very trustless!

c) Mine the coins yourself. But unless you build a bitcoin miner from scratch, you need to trust the hardware and software (how do you know for sure that it isn't mining to someone else's account?) And your miner needs to be connected to the internet, so hackers could get your coins.

There are no good trustless options. You have to accept some risk.

EDIT: I missed the only tried and true trustless way to get bitcoins:

d) Hack/phish/con someone else out of their bitcoins!

[runeks]

Why is this relevant? It doesn’t matter how OP obtained their bitcoins — trustlessly or not — what matters is that OP now has them and want to keep them without trusting a hardware wallet company.

[TacticalCoder]

> You've missed step 0 (and earlier): how did you trustlessly obtain the bitcoin in the first place? Your options aren't good here:

You're missing an easy and obvious option.

You plan to buy 10 Bitcoin (not saying it's a good idea): you wire tx enough to buy one on Gemini or Coinbase (or whatever exchange fits you), wait for the tx to clear, buy one Bitcoin, move it to your hardware wallet. Rinse and repeat 9 more times.

At any one time you're never exposed to more than 1/10th of the amount you planned to buy.

I think a lot of highly speculative investors but still cautious people proceeded that way.

There are even sites tracking the Bitcoin and Ethereum and whatnots addresses accumulating coins on a regular basis.

[Geee]

This is the world outside of Bitcoin, and is irrelevant to this question. For these transactions, you have faith in your legal system, government, democracy etc. If you're scammed by an exchange, you sue them and you should get your money back.

[8organicbits]

With a typical currency the answer of "how to get money" is to get a job. Trustless usually isn't a concern, in that paychecks are reliable and worker protection laws exist. (Not saying it's perfect, just stating the status quo). The lack of a bitcoin economy prevents or frustrates this approach.

With typical currencies, you can exchange at a currency exchange counter at the border/airport or use your bank/credit card which handles the conversion behind the scenes. I suppose the equivalent for bitcoin is a bitcoin ATM or bitcoin credit card.

[JonathanBeuys]

You can obtain them via as many small transactions as you like. Never trusting anyone with more than the transaction amount.

[teawrecks]

Where is the risk with a? Seems like you yourself explain why it would work fine. If you get the coins, great. If not, you do a classic charge back.

Either way, trust of everything outside of owning your coins is irrelevant to the exercise. If you're going to play devil's advocate, you need to come up with relevant counter examples.

[pjc50]

And the reverse is even more important: having spent immense time and effort to acquire the output of a random number generator, how can you ensure it preserves its value when you want to actually exchange it for something? Given the 2/3 fall from the peak against the stabledollar this is a real risk.

[Yeahsureok]

Bisq - P2P trading, pay by cash deposit into a strangers bank account

[runeks]

The solution is to replace the hardware wallet with a Raspberry Pi, or similar hardware device, and use open source wallet software. However you need to be able to disable the Wi-Fi of the hardware device so that the device that holds the keys is offline.

[chromatin]

Check out https://seedsigner.com/ which does precisely this.

[lrvick]

If the threat model includes side channel and supply chain attacks then something like the Precursor would be a better bet because you still need a rusted input method and screen.

[lfpeb8b45ez]

You’ll need to first discover if you can trust yourself. Make sure you don’t sleepwalk, test your susceptibility to hypnotic suggestion, and talk to a medical professional you trust about other possible health conditions that could jeopardize your assets. Unfortunately, there are few cryptographically verifiable medical professionals.

[Peleus]

Step 1 is going to be figure out what you are prepared to trust and work upwards from there.

There will always be an infinitely recursive list of trust issues or potential attack vectors, they will just become less and less likely.

What if the hardware wallet is backdoored? Use a Faraday cage. What if both the hardware wallet and Faraday cage is compromised? etc.

[mightybyte]

There is still some trust hidden away in step 10 that you didn't call out, which is that you're trusting the software wallet. The software wallet that you use to create the transaction could under the hood create a different transaction than what you expect and show you the hash of that transaction. A hardware wallet that signs a raw hash will always be vulnerable to this kind of attack. To really eliminate the need to trust the software wallet, you should send the whole transaction to the hardware wallet so the hardware wallet can calculate the hash. You're still trusting the hardware wallet to some extent but you entered your seed phrase into the hardware wallet so you're implicitly trusting that no matter what.

[ALittleLight]

This method is still vulnerable to rubber hose cryptanalysis - which is what I'd worry about.

[Geee]

Everything that is non-verifiable, requires trust. So, if you can verify that your hardware works correctly, you don't need to trust the manufacturer or supply chains. There are ways to verify that hardware works correctly.

3: You measure RF signals to verify that there's no wireless connection of any kind.

6: You can verify the public key by using multiple devices from different vendors with the same seed.

Practically speaking, you don't need to verify everything yourself. It's guaranteed that any information about attacks will be quickly available, if someone is able to verify everything.

[andreskytt]

Your hardware might either leak the private key via a non-internet connection (bluetooth, nfc, physical interface, some non-standard protocol). Also, it might use weak crypto to generate the private key (see ROCA vulnerability). Trusting non-trivial hardware is hard as it takes very little to have it behave maliciously under very specific circumstance.

[_ink_]

I think you left out one important part, which might lead to losing your funds! When you withdraw only a portion from your bitcoin wallet the default behaviour is that that your wallet is still emptied completly. The leftover amount is transferred to a different wallet generated by the software wallet you use to generate the transaction. I am not sure if the new private key could be restored from the original private, if you would delete the software wallet after the transaction.

There is no good solution.

You can specify multiple recipients, so you could send the leftover back to your secure wallet. But reusing adresses after a transaction is considered insecure (I don't know why).

Or you have a second secure hardware wallet, that can receive the leftover.

[pcdoodle]

Download green wallet by blockstream and call it a day. Make sure to close all other apps before opening it. Write your seed phrase down and give it to your Mom.

[shaicoleman]

Instead of trying to eliminate trust, a better approach would be to decentralize trust.

There are various solutions for that, e.g. multi-sig, Shamir's Secret Sharing, etc.