Hi everyone, I am a blockchain engineer and run a small blockchain shop (Biglup Labs) mostly working on the Cardano ecosystem, I maintain a few open source crypto libraries as well as an implementation for Cardano for the SeedSigner, my github: AngelCastilloB (Angel Castillo) · GitHub
I am trying to bring the SeedSigner to as many blockchain ecosystems as possible since I truly believe is a superior hardware wallet solution to commercial alternatives out there (you can see more of the SeedSigner project here https://seedsigner.com/). I must clarify that I am not part of the team that develop and mantains the SeedSigner for Bitcoin, I just really like the device/project and then operational model, and I am trying to bring it to more blockchains.
The idea then, would be to bring the SeedSigner model to Zcash. For those that dont in detail, SeedSigner is one of the most trusted DIY signing devices in bitcoin, you build it yourself from off the shelf parts, a raspberry pi zero 1.3, a small LCD and a camera module, around 35$ total. The pi zero 1.3 has no wifi or bluetooth chip on the board at all, so the air gap is physical. Seeds live only in RAM and are wiped on power off, all communication with the host wallet is animated QR codes in both directions, and the whole stack (OS image and application) is open source and reproducible.
There is no vendor, nobody ships you anything, you can buy the parts anywhere and no one in the supply chain knows what they are for. For a privacy coin IMO this matters even more than for bitcoin, buying a hardware wallet creates a shipping record linking your identity to crypto ownership (I.E Ledger customer database leak), buying a pi and a camera module doesnt.
Architecture wise this would be PCZT (ZIP 374). The host wallet builds the transaction and the halo2 proofs, the device only holds the spending keys, independently verifies what it is about to sign, and produces the redpallas spend authorization signatures. Is the same prover/signer split that Keystone uses. The important part, is that the device derives the ZIP 244 sighash from the transaction data itself, on device, it never accepts a hash from the companion app, so a corrupted host cannot feed it a blank check. Recipients, amounts and fee get recomputed and shown on the trusted screen before anything is signed.
I built a simple PoC and ran it on the real hardware. Code is here: GitHub - Biglup/libzcash-signer: Air-gapped Zcash PCZT signer core for SeedSigner-class hardware. On-device ZIP-244 sighash, RedPallas signing, benchmarked on a Raspberry Pi Zero 1.3. · GitHub
It parses a PCZT, derives the orchard keys via zip32, recomputes the sighash on device, signs, and then verifies its own signature against the randomized verification key. These are the numbers from an actual raspberry pi zero rev 1.3 (BCM2835, 512MB), 20 iterations:
```
phase median max
parse PCZT 67 ms 153 ms
sign (derive + sighash + sign + verify, 2 actions) 676 ms 1.58 s
peak memory 1.2 MB -
```
So around 0.34s per action and 1.2MB of ram on a 512MB board, a 16 action transaction would sign in about 5 seconds, there is no transaction size ceiling like the MCU based devices have.
Scope I have in mind for a grant application: Ironwood pool signing plus legacy orchard spends. Over animated QR, speaking the same UR flow Zodl already uses for Keystone, so it would work with stock Zodl from day one, no wallet side changes needed.
Is there real appetite for a DIY open source signer next to the commercial options?, I know Keystone works well today, this is not meant to replace it, is a different trust model for people that dont want a vendor in the loop.
Some references:
- SeedSigner (bitcoin): GitHub - SeedSigner/seedsigner: Use an air-gapped Raspberry Pi Zero to sign for Bitcoin transactions! (and do other cool stuff) · GitHub
- Cardano SeedSigner (my previous work): GitHub - Biglup/cardano-seedsigner: Use an air-gapped Raspberry Pi Zero to sign for Cardano transactions · GitHub
- ZIP 374 (PCZT): ZIP 374: Partially Created Zcash Transaction Format
- The signer core + benchmarks: GitHub - Biglup/libzcash-signer: Air-gapped Zcash PCZT signer core for SeedSigner-class hardware. On-device ZIP-244 sighash, RedPallas signing, benchmarked on a Raspberry Pi Zero 1.3. · GitHub