Grant application - Zcash SeedSigner, a DIY open source air gapped signer for shielded ZEC

Community Grants
1

Hi everyone, following up on the concept thread from August ( Feedback wanted: a DIY, open source, air-gapped signer for shielded ZEC (SeedSigner model) ), I just submitted the formal application to ZCG:

Quick summary for those that didnt see the concept thread: bring the SeedSigner model to Zcash, a DIY air gapped signer you build yourself from off the shelf parts (~$35, a pi zero 1.3 with no radio silicon, LCD and camera), signing Ironwood and legacy Orchard PCZTs with on device sighash recomputation and clear signing, over the same UR QR protocol Zodl already uses for Keystone. No vendor, no purchase record, fully open source and reproducible.

Here is a benchmarked on the real hardware: GitHub - Biglup/libzcash-signer: Air-gapped Zcash PCZT signer core for SeedSigner-class hardware. On-device ZIP-244 sighash, RedPallas signing, benchmarked on a Raspberry Pi Zero 1.3. · GitHub

The ask is $65k total: $50k for ~8 months of development across 4 milestones, plus a $15k external audit itemized as its own severable milestone so ZCG can approve or defer it independently.

Happy to answer any questions here, and feedback is very welcome before the committee takes it up :folded_hands:

2 Likes
Feedback wanted: a DIY, open source, air-gapped signer for shielded ZEC (SeedSigner model)
2

One detail worth calling out: reject_dummy_spending_keys refuses a PCZT that still carries a dummy_sk instead of quietly skipping the spend. That is the ZIP 374 rule, and our own two signers did not implement it, so reading yours got an issue opened against ours.

Konclave is a collective FROST treasury on Zcash, and today a member’s key share sits in browser storage, which can be evicted. A 35 dollar air gapped signer is the obvious upgrade for anyone who wants one, so this proposal is directly interesting to us.

Hence one question, and I know it is outside your scope. M2 conforms to the UR flow Zodl already uses for Keystone, which is the right call for interop. Does conforming leave room for a second mode later, where the device returns a nonce commitment first and a signature share second under a rerandomizer, or would that need a new UR type and buy-in upstream? Not asking you to build it. It only matters whether the door stays open.

One argument for the DIY model I have not seen made here: threshold signing buys redundancy against one person failing, and nothing against one vendor failing, because that failure lands on every member at once. A 3-of-4 does not survive its four signers going dark together. Cheap and reproducible is worth more to a group than to an individual.

Good luck with it.

1 Like
3

Hi @danielgorgonha

Does conforming leave room for a second mode later, where the device returns a nonce commitment first and a signature share second under a rerandomizer, or would that need a new UR type and buy-in upstream? Not asking you to build it. It only matters whether the door stays open.

We could define a specific mode for this on the device, the round data can be in PCZT proprietary fields or proper UR types (would be nicer), and the device holds the nonce in RAM between two scans of the same session, 100% doable

1 Like